Cisco Secure Pix Firewall Advanced Student Guide Version 2.1

CSPFA

Cisco Secure PIX Firewall Advanced

Student Guide Version 2.1

Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA

The products and specifications, configurations, and other technical information regarding the products in this manual are subject to change without notice. All statements, technical information, and recommendations in this manual are believed to be accurate but are presented without warranty of any kind, express or implied. You must take full responsibility for their application of any products specified in this manual. LICENSE PLEASE READ THESE TERMS AND CONDITIONS CAREFULLY BEFORE USING THE MANUAL, DOCUMENTATION, AND/OR SOFTWARE (“MATERIALS”). BY USING THE MATERIALS YOU AGREE TO BE BOUND BY THE TERMS AND CONDITIONS OF THIS LICENSE. IF YOU DO NOT AGREE WITH THE TERMS OF THIS LICENSE, PROMPTLY RETURN THE UNUSED MATERIALS (WITH PROOF OF PAYMENT) TO THE PLACE OF PURCHASE FOR A FULL REFUND. Cisco Systems, Inc. (“Cisco”) and its suppliers grant to you (“You”) a nonexclusive and nontransferable license to use the Cisco Materials solely for Your own personal use. If the Materials include Cisco software (“Software”), Cisco grants to You a nonexclusive and nontransferable license to use the Software in object code form solely on a single central processing unit owned or leased by You or otherwise embedded in equipment provided by Cisco. You may make one (1) archival copy of the Software provided You affix to such copy all copyright, confidentiality, and proprietary notices that appear on the original. EXCEPT AS EXPRESSLY AUTHORIZED ABOVE, YOU SHALL NOT: COPY, IN WHOLE OR IN PART, MATERIALS; MODIFY THE SOFTWARE; REVERSE COMPILE OR REVERSE ASSEMBLE ALL OR ANY PORTION OF THE SOFTWARE; OR RENT, LEASE, DISTRIBUTE, SELL, OR CREATE DERIVATIVE WORKS OF THE MATERIALS. You agree that aspects of the licensed Materials, including the specific design and structure of individual programs, constitute trade secrets and/or copyrighted material of Cisco. You agree not to disclose, provide, or otherwise make available such trade secrets or copyrighted material in any form to any third party without the prior written consent of Cisco. You agree to implement reasonable security measures to protect such trade secrets and copyrighted Material. Title to the Materials shall remain solely with Cisco. This License is effective until terminated. You may terminate this License at any time by destroying all copies of the Materials. This License will terminate immediately without notice from Cisco if You fail to comply with any provision of this License. Upon termination, You must destroy all copies of the Materials. Software, including technical data, is subject to U.S. export control laws, including the U.S. Export Administration Act and its associated regulations, and may be subject to export or import regulations in other countries. You agree to comply strictly with all such regulations and acknowledge that it has the responsibility to obtain licenses to export, re-export, or import Software. This License shall be governed by and construed in accordance with the laws of the State of California, United States of America, as if performed wholly within the state and without giving effect to the principles of conflict of law. If any portion hereof is found to be void or unenforceable, the remaining provisions of this License shall remain in full force and effect. This License constitutes the entire License between the parties with respect to the use of the Materials Restricted Rights - Cisco’s software is provided to non-DOD agencies with RESTRICTED RIGHTS and its supporting documentation is provided with LIMITED RIGHTS. Use, duplication, or disclosure by the U.S. Government is subject to the restrictions as set forth in subparagraph “C” of the Commercial Computer Software - Restricted Rights clause at FAR 52.227-19. In the event the sale is to a DOD agency, the U.S. Government’s rights in software, supporting documentation, and technical data are governed by the restrictions in the Technical Data Commercial Items clause at DFARS 252.227-7015 and DFARS 227.7202. DISCLAIMER OF WARRANTY. ALL MATERIALS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. In no event shall Cisco’s or its suppliers’ liability to You, whether in contract, tort (including negligence), or otherwise, exceed the price paid by You. The foregoing limitations shall apply even if the abovestated warranty fails of its essential purpose. The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with Cisco’s installation

instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation. You can determine whether your equipment is causing interference by turning it off. If the interference stops, it was probably caused by the Cisco equipment or one of its peripheral devices. If the equipment causes interference to radio or television reception, try to correct the interference by using one or more of the following measures: • Turn the television or radio antenna until the interference stops. • Move the equipment to one side or the other of the television or radio. • Move the equipment farther away from the television or radio. • Plug the equipment into an outlet that is on a different circuit from the television or radio. (That is, make certain the equipment and the television or radio are on circuits controlled by different circuit breakers or fuses.) Modifications to this product not authorized by Cisco Systems, Inc. could void the FCC approval and negate your authority to operate the product. The following third-party software may be included with your product and will be subject to the software license agreement: CiscoWorks software and documentation are based in part on HP OpenView under license from the HewlettPackard Company. HP OpenView is a trademark of the Hewlett-Packard Company. Copyright © 1992, 1993 Hewlett-Packard Company. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. Network Time Protocol (NTP). Copyright © 1992, David L. Mills. The University of Delaware makes no representations about the suitability of this software for any purpose. Point-to-Point Protocol. Copyright © 1989, Carnegie-Mellon University. All rights reserved. The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission. The Cisco implementation of TN3270 is an adaptation of the TN3270, curses, and termcap programs developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981-1988, Regents of the University of California. Cisco incorporates Fastmac and TrueView software and the RingRunner chip in some Token Ring products. Fastmac software is licensed to Cisco by Madge Networks Limited, and the RingRunner chip is licensed to Cisco by Madge NV. Fastmac, RingRunner, and TrueView are trademarks and in some jurisdictions registered trademarks of Madge Networks Limited. Copyright © 1995, Madge Networks Limited. All rights reserved. XRemote is a trademark of Network Computing Devices, Inc. Copyright © 1989, Network Computing Devices, Inc., Mountain View, California. NCD makes no representations about the suitability of this software for any purpose. The X Window System is a trademark of the X Consortium, Cambridge, Massachusetts. All rights reserved. Cisco Systems has more than 200 offices in the following countries and regions. Addresses, phone numbers, and fax numbers are listed on the Cisco Web site at www.cisco.com/go/offices.

Argentina Australia Austria Belgium Brazil Bulgaria Canada Chile China PRC Colombia Costa Rica Croatia Czech Republic Denmark Dubai, UAE Finland France Germany Greece Hong Kong SAR Hungary India Indonesia Ireland Israel Italy Japan Korea Luxembourg Malaysia Mexico The Netherlands New Zealand Norway Peru Philippines Poland Portugal Puerto Rico Romania Russia Saudi Arabia Scotland Singapore Slovakia Slovenia South Africa Spain Sweden Switzerland Taiwan Thailand Turkey Ukraine United Kingdom United States Venezuela Vietnam Zimbabwe Copyright  2001, Cisco Systems, Inc. All rights reserved. AccessPath, AtmDirector, Browse with Me, CCDA, CCDE, CCDP, CCIE, CCNA, CCNP, CCSI, CD-PAC, CiscoLink, the Cisco NetWorks logo, the Cisco Powered Network logo, Cisco Systems Networking Academy, Fast Step, Follow Me Browsing, FormShare, FrameShare, GigaStack, IGX, Internet Quotient, IP/VC, iQ Breakthrough, iQ Expertise, iQ FastTrack, the iQ logo, iQ Net Readiness Scorecard, MGX, the Networkers logo, Packet, RateMUX, ScriptBuilder, ScriptShare, SlideCast, SMARTnet, TransPath, Unity, Voice LAN, Wavelength Router, and WebViewer are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Discover All That’s Possible, and Empowering the Internet Generation, are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, Cisco, the Cisco Certified Internetwork Expert Logo, Cisco IOS, the Cisco IOS logo, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub, FastSwitch, IOS, IP/TV, LightStream, MICA, Network Registrar, PIX, Post-Routing, Pre-

Routing, Registrar, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.

All other brands, names, or trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0104R)

Cisco Secure PIX Firewall Advanced, Revision 2.1: Student Guide Copyright  2002, Cisco Systems, Inc. All rights reserved. Printed in USA.

Table of Contents

COURSE INTRODUCTION

1-1

Overview Course Objectives Lab Topology

1-1 1-2 1-7

NETWORK SECURITY AND THE CISCO PIX FIREWALL

2-1

Overview Objectives Network Security Cisco AVVID and SAFE Summary

2-1 2-2 2-3 2-13 2-26

CISCO PIX FIREWALL MODELS AND FEATURES

3-1

Overview Objectives Firewalls Overview of the PIX Firewall Summary

3-1 3-2 3-3 3-8 3-22

IDENTIFY THE CISCO PIX FIREWALL

4-1

Overview Objectives Identify the PIX Firewall 501 Controls and Connectors Identify the PIX Firewall 506 Controls and Connectors Identify the PIX Firewall 515 Controls and Connectors Identify the PIX Firewall 520 Controls and Connectors Identify the PIX Firewall 525 Controls and Connectors Identify the PIX Firewall 535 Controls and Connectors Summary

4-1 4-2 4-3 4-5 4-7 4-11 4-14 4-17 4-21

BASIC CONFIGURATION OF THE CISCO PIX FIREWALL

5-1

Overview Objectives General Maintenance Commands ASA Security Levels The Six Primary Commands Summary

Copyright  2002, Cisco Systems, Inc.

5-1 5-2 5-3 5-20 5-23 5-35

Table of Contents

v

Lab Exercise―Configure the PIX Firewall and Execute General Maintenance Commands

CISCO PIX FIREWALL TRANSLATIONS

6-1

Overview Objectives Transport Protocols PIX Firewall Translations Access Through the PIX Firewall Other Ways Through the PIX Firewall Summary Lab Exercise—Configuring Access Through the PIX Firewall

CONFIGURING MULTIPLE INTERFACES

DYNAMIC HOST CONFIGURATION PROTOCOL SUPPORT Overview Objectives Dynamic Host Configuration Protocol The PIX Firewall as a DHCP Server The PIX Firewall as a DHCP Client Summary Lab Exercise—Configure the PIX Firewall’s DHCP Server and Client Features

CONFIGURING SYSLOG

ACCESS CONTROL CONFIGURATION AND CONTENT FILTERING

Cisco Secure PIX Firewall Advanced 2.1

7-1 7-2 7-3 7-8 Lab 7-1

8-1 8-1 8-2 8-3 8-5 8-15 8-19 Lab 8-1

9-1

Overview Objectives Syslog Messages Summary Lab Exercise—Configure Syslog Output to a Syslog Host or Server from the PIX Firewall

vi

6-1 6-2 6-3 6-9 6-13 6-19 6-29 Lab 6-1

7-1

Overview Objectives Configuring Additional Interfaces Summary Lab Exercise—Configure Inside Multiple Interfaces

Overview Objectives Access Control Lists Converting Conduits to Access Control Lists Configuring Access Control Malicious Active Code Filtering

Lab 5-1

9-1 9-2 9-3 9-10 Lab 9-1

10-1 10-1 10-2 10-3 10-9 10-17 10-25

Copyright  2002, Cisco Systems, Inc.

URL Filtering Summary Lab Exercise—Configure ACLs in the PIX Firewall

10-30 10-33 Lab 10-1

ADVANCED PROTOCOL HANDLING

11-1

Overview Objectives Advanced Protocols Multimedia Support Summary Lab Exercise—Configure and Test Advanced Protocol Handling on the Cisco PIX Firewall

11-1 11-2 11-3 11-15 11-25 Lab-1

ATTACK GUARDS AND INTRUSION DETECTION

12-1

Overview Objectives Attack Guards Intrusion Detection Summary Lab Exercise—Configure the PIX Firewall to Use IDS Signatures

12-1 12-2 12-3 12-13 12-21 Lab 12-1

AUTHENTICATION, AUTHORIZATION, AND ACCOUNTING CONFIGURATION ON THE CISCO PIX FIREWALL

13-1

Overview Objectives Introduction Installation of CSACS for Windows NT Authentication Configuration Authorization Configuration Accounting Configuration Troubleshooting the AAA Configuration Summary Lab Exercise―Configure AAA on the PIX Firewall Using CSACS for Windows NT

13-1 13-2 13-3 13-8 13-12 13-30 13-37 13-44 13-47 Lab 13-1

FAILOVER

14-1 Overview Objectives Understand Failover Configure Failover Summary Lab Exercise—Configure Failover

14-1 14-2 14-3 14-7 14-14 Lab 14-1

VIRTUAL PRIVATE NETWORK CONFIGURATION

15-1

Overview Copyright  2002, Cisco Systems, Inc.

1 Table of Contents

vii

Objectives The PIX Firewall Enables a Secure VPN IPSec Configuration Tasks Task 1—Prepare to Configure VPN Support Task 2—Configure IKE Parameters Task 3—Configure IPSec Parameters Task 4—Test and Verify VPN Configuration The Cisco VPN Client 3.1 Scale PIX Firewall VPNs Summary Lab Exercise—Configure PIX Firewall VPNs

15-2 15-3 15-10 15-12 15-19 15-23 15-33 15-35 15-45 15-47 Lab 15-1

SYSTEM MAINTENANCE

16-1

Overview Objectives Password Recovery Image Upgrade Summary Lab Exercise—Upgrade the PIX Firewall Image

CISCO PIX DEVICE MANAGER

17-1

Overview Objectives PDM Overview PDM Operating Requirements Prepare for PDM Using PDM Other Tools Summary Lab Exercise—Configuring the PIX Firewall with PDM

THE CISCO IOS FIREWALL CONTEXT-BASED ACCESS CONTROL CONFIGURATION Overview Objectives Introduction to the Cisco IOS Firewall Context-Based Access Control Global Timeouts and Thresholds Port-to-Application Mapping Define Inspection Rules Inspection Rules and ACLs Applied to Router Interfaces Test and Verify Summary Lab Exercise—Configure CBAC on a Cisco Router

viii

Cisco Secure PIX Firewall Advanced 2.1

16-1 16-2 16-3 16-7 16-13 Lab 16-1

17-1 17-2 17-4 17-7 17-11 17-15 17-28 17-31 Lab 17-1

18-1 18-1 18-2 18-3 18-8 18-16 18-25 18-30 18-39 18-48 18-51 Lab 18-1

Copyright  2002, Cisco Systems, Inc.

CISCO IOS FIREWALL AUTHENTICATION PROXY CONFIGURATION Overview Objectives Introduction to the Cisco IOS Firewall Authentication Proxy AAA Server Configuration AAA Configuration Authentication Proxy Configuration Test and Verify the Configuration Summary Lab Exercise—Configure Authentication Proxy on a Cisco Router

Copyright  2002, Cisco Systems, Inc.

19-1 19-1 19-2 19-3 19-9 19-12 19-21 19-24 19-27 Lab 19-1

Table of Contents

ix

x

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

1

Course Introduction

Overview This chapter includes the following topics: ■

Course objectives

■

Course agenda

■

Participant responsibilities

■

General administration

■

Graphic symbols

■

Participant introductions

■

Lab topology

Course Objectives This section introduces the course and the course objectives.

Course Objectives Upon completion of this course, you will be able to perform the following tasks: • Identify PIX Firewall features, models, components, and benefits. • Describe PIX Firewall installation procedures. • Upgrade software images. • Configure inbound and outbound access through the PIX Firewall. • Configure multiple interfaces on the PIX Firewall. • Configure the PIX Firewall as a DHCP server. • Configure the PIX Firewall as a DHCP client. • Configure the PIX Firewall to send messages to a Syslog server. • Perform password recovery. • Configure access control and control filtering on the PIX Firewall.

© 2002, Cisco Systems, Inc.

1-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—1-3

Copyright  2002, Cisco Systems, Inc.

Course Objectives (cont.) • Configure special protocol handling on the PIX Firewall. • Configure attack guards and SSH. • Configure AAA on the PIX Firewall. • Configure and test failover using the PIX Firewall. • Configure the IDS feature set. • Configure a site-to-site VPN using the PIX Firewall. • Configure a VPN Client-to-PIX Firewall VPN. • Test and verify PIX Firewall operations. • Install the PIX Device Manager and use it to configure the PIX Firewall. • Configure Cisco IOS Firewall CBAC. • Configure an authentication proxy with Cisco IOS software.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—1-4

Course Agenda • Chapter 1—Course Introduction • Chapter 2—Network Security and the Cisco PIX Firewall • Chapter 3—Cisco PIX Firewall Technology • Chapter 4—Identifying the Cisco PIX Firewall • Chapter 5—Basic Configuration of the PIX Firewall • Chapter 6—PIX Firewall Translations • Chapter 7—Configuring Multiple Interfaces • Chapter 8—Dynamic Host Configuration Protocol Support • Chapter 9—Configuring Syslog • Chapter 10—Access Control Configuration and Content Filtering © 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—1-5

Course Introduction

1-3

Course Agenda (cont.) • Chapter 11—Advanced Protocol Handling • Chapter 12—Attack Guards and Intrusion Detection • Chapter 13—Authentication, Authorization, and Accounting Configuration on the Cisco Secure PIX Firewall • Chapter 14—Failover • Chapter 15—VPN Configuration • Chapter 16—System Maintenance • Chapter 17—PIX Device Manager • Chapter 18—Cisco IOS Firewall Context-Based Access Control Configuration • Chapter 19—Cisco IOS Firewall Authentication Proxy Configuration © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—1-6

Participant Responsibilities Student Responsibilities • Complete prerequisites • Participate in lab exercises • Ask questions • Provide feedback

© 2002, Cisco Systems, Inc.

1-4

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—1-7

Copyright  2002, Cisco Systems, Inc.

General Administration

Class-related

Facilities-related

• Sign-in sheet

• Participant materials

• Length and times

• Site emergency procedures

• Break and lunch room locations

• Restrooms

• Attire

• Telephones/faxes

www.cisco.com

© 2002, Cisco Systems, Inc.

CSPFA 2.1—1-8

Graphic Symbols

PIX Firewall

Ethernet link

Router

Internet

NT server: web, FTP, TFTP, Syslog server

© 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

Cisco IOS Firewall

PC, workstation, or server

www.cisco.com

CSPFA 2.1—1-9

Course Introduction

1-5

Participant Introductions •Your name •Your company •Pre-req skills •Brief history •Objective

© 2002, Cisco Systems, Inc.

1-6

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—1-10

Copyright  2002, Cisco Systems, Inc.

Lab Topology This section explains the lab topology that is used in this course.

PIX Lab Visual Objective Pod 1

e0/1 172.30.P.0 /24

R1 Perimeter Router

Internet

.2 e0/1

NT Server: FTP, web

.1 e0/0 192.168.P.0/24 e0 Outside .2

PIX Firewall e1 Inside .1

172.30.P.0 /24

Pod 2

.2 e0/1

172.26.26.50

e2 DMZ .1 172.16.P.0 /24

172.16.P.0 /24 .2 web Server

10.0.P.0 /24

NT server Websense server

© 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

.1 e0/0 192.168.P.0/24 e0 Outside .2

e2 DMZ .1

.2 web Server

R2 Perimeter Router

PIX Firewall e1 Inside .1 10.0.P.0 /24

10.0.P.3

NT server Websense server

www.cisco.com

10.0.P.3

CSPFA 2.1—1-12

Course Introduction

1-7

Failover Visual Objective 172.30.1.50 /24

Internet

Backbone server web, FTP, and TFTP server .1

192.168.P.0 /24 failover cable

e0 .2 Primary PIX Firewall e1 .1

e0 .7

Secondary PIX Firewall

e2 .1

172.16.P.0 /24

e2 .7 e1 .7

.2 DMZ

10.0.P.0 /24

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—1-13

Each pair of students will be assigned a pod. The P in a command indicates your pod number. The Q in a command indicates the pod number of your peer.

1-8

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

2

Network Security and the Cisco PIX Firewall

Overview This chapter includes the following topics: ■

Objectives

■

Network security

■

Cisco AVVID and Safe

■

Summary

Objectives This section lists the chapter’s objectives.

Objectives Upon completion of this chapter, you will be able to perform the following tasks: • State the reasons for securing computer networks. • Define computer hacking and describe the four primary threats associated with that activity. • Define the four primary types of threats against network security. • Describe the three primary methods of attack against today’s computer networks. • Describe the purpose of the Security Wheel. • Describe the Cisco AVVID architecture. • Describe the SAFE framework. © 2002, Cisco Systems, Inc.

2-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—2-2

Copyright  2002, Cisco Systems, Inc.

Network Security This section explains what network security is and why you need it.

Network Security Is Essential

Network security is essential because the Internet has made networked computers accessible and vulnerable.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-4

Network security is essential because the Internet is a network of interconnected networks without a boundary. Because of this fact, the organizational network becomes accessible and vulnerable from any computer in the world. As companies become Internet businesses, new threats arise from persons who no longer require physical access to a company’s computer assets. In a recent survey conducted by the Computer Security Institute (CSI), 70 percent of the organizations polled stated that their network security defenses had been breached and that 60 percent of the incidents came from within the organizations themselves.

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-3

Network Security Threats There are four primary threats to network security: • Unstructured threats • Structured threats • External threats • Internal threats

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-5

There are four primary threats to network security: ■

Unstructured threats

■

Structured threats

■

External threats

■

Internal threats

Unstructured threats consist of mostly inexperienced individuals using easily available hacking tools from the Internet. Some of the people in this category are motivated by malicious intent, but most are motivated by the intellectual challenge and are commonly known as script kiddies. They are not the most talented or experienced hackers, but they have the motivation, which is all that matters. Structured threats consist of hackers who are more highly motivated and technically competent. They usually understand network system designs and vulnerabilities, and they can understand as well as create hacking scripts to penetrate those network systems. External threats are individuals or organizations working outside your company who do not have authorized access to your computer systems or network. They work their way into a network mainly from the Internet or dialup access servers. Internal threats occur when someone has authorized access to the network with either an account on a server or physical access to the wire. They are typically disgruntled former or current employees or contractors.

2-4

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Three Primary Network Attacks There are three types of network attacks: • Reconnaissance attacks • Access attacks • Denial of service attacks

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-6

There are three types of network attacks: ■

Reconnaissance attacks—An intruder attempts to discover and map systems, services, and vulnerabilities.

■

Access attacks—An intruder attacks networks or systems to retrieve data, gain access, or escalate their access privilege.

■

Denial of service (DoS) attacks—An intruder attacks your network in such a way that damages or corrupts your computer system, or denies you and others access to your networks, systems, or services.

Reconnaissance Attacks Reconnaissance is the unauthorized discovery and mapping of systems, services, or vulnerabilities. It is also known as information gathering and, in most cases, precedes an actual access or DoS attack. The malicious intruder typically ping sweeps the target network first to determine what IP addresses are alive. After this is accomplished, the intruder determines what services or ports are active on the live IP addresses. From this information, the intruder queries the ports to determine the application type and version as well as the type and version of the operating system running on the target host. Reconnaissance is somewhat analogous to a thief scoping out a neighborhood for vulnerable homes that they can break into, such as an unoccupied residence, an easy-to-open door or window, and so on. In many cases the intruders go as far as “rattling the door handle,” not to go in immediately if it is opened, but to discover vulnerable services that they can exploit at a later time when there is less likelihood that anyone is looking.

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-5

Access Attacks Access is an all-encompassing term that refers to unauthorized data manipulation, system access, or privileged escalation. Unauthorized data retrieval is simply reading, writing, copying, or moving files that are not intended to be accessible to the intruder. Sometimes this is as easy as finding share folders in Windows 9x or NT, or NFS exported directories in UNIX systems with read or read and write access to everyone. The intruder will have no problems getting to the files and, more often than not, the easily accessible information is highly confidential and completely unprotected to prying eyes, especially if the attacker is already an internal user. System access is the ability of an intruder to gain access to a machine, which the intruder is not allowed access to (for example, the intruder does not have an account or password). Entering or accessing systems which one does not have access to usually involves running a hack, script, or tool that exploits a known vulnerability of the system or application being attacked. Another form of access attacks involves privileged escalation. This is done by legitimate users with a lower level of access privileges, or intruders who have gained lower privileged access. The intent is to get information or execute procedures that are not authorized at their current level of access. In many cases this involves gaining root access in a UNIX system to install a sniffer to record network traffic, such as usernames and passwords which can be used to access another target. In some cases, intruders only want to gain access without wanting to steal information—especially when the motive is intellectual challenge, curiosity, or ignorance.

DoS Attacks DoS is when an attacker disables or corrupts networks, systems, or services with the intent to deny the service to intended users. It usually involves either crashing the system or slowing it down to the point that it is unusable. But DoS can also be as simple as wiping out or corrupting information necessary for business. In most cases, performing the attack simply involves running a hack, script, or tool. The attacker does not need prior access to the target because all that is usually required is a way to get to it. For these reasons and because of the great damaging potential, DoS attacks are the most feared—especially by e-commerce web site operators.

2-6

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Network Security as a Continuous Process Network security is a continuous process built around a security policy. • Step 1: Secure

Secure

Improve

Security Policy

Monitor

• Step 2: Monitor • Step 3: Test Test

• Step 4: Improve

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-7

Network security should be a continuous process built around a security policy. A continuous security policy is most effective because it promotes retesting and reapplying updated security measures on a continuous basis. This continuous security process is represented by the Security Wheel. To begin this continuous process known as the Security Wheel, you need to create a security policy that enables the application of security measures. A security policy needs to accomplish the following tasks: ■

Identify the organization’s security objectives.

■

Document the resources to be protected.

■

Identify the network infrastructure with current maps and inventories.

To create or implement an effective security policy, you need to determine what it is you want to protect and in what manner you are going to protect it. You should know and understand your network’s weak points and how they can be exploited. You should also understand how your system normally functions so that you know what to expect and are familiar with how the devices are normally used. Finally, consider the physical security of your network and how to protect it. Physical access to a computer, router, or firewall can give a user total control over that device. After the security policy is developed, it becomes the hub upon which the next four steps of the Security Wheel are based: Step 1

Secure the system. This involves implementing security devices—firewalls, identification authentication systems, encryption, and so on—with the intent to prevent unauthorized access to network systems. This is where the Cisco Secure PIX Firewall is effective.

Step 2

Monitor the network for violations and attacks against the corporate security policy. Violations can occur within the secured perimeter of the network from a disgruntled employee or from the outside of the network from a hacker.

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-7

Monitoring the network with a real-time intrusion detection system, such as the Cisco Secure Intrusion Detection System, can ensure that the security devices in Step 1 have been configured properly. Step 3

Test the effectiveness of the security safeguards in place. Use the Cisco Secure Scanner to identify the security posture of the network with respect to the security procedures that form the hub of the Security Wheel.

Step 4

Improve corporate security. Collect and analyze information from the monitoring and testing phases to make security improvements. All four steps—secure, monitor, test, and improve—should be repeated on a continuous basis and should be incorporated into updated versions of the corporate security policy.

2-8

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Secure the Network Implement security solutions to stop or prevent unauthorized access or activities, and to protect information. • • • •

Secure

Improve

Authentication Encryption Firewalls Vulnerability Patching

© 2002, Cisco Systems, Inc.

Security Policy

Monitor

Test

www.cisco.com

CSPFA 2.1—2-8

Secure the network by applying the security policy and implementing the following security solutions: ■

Authentication—Gives access to authorized users only (for example, using one-time passwords).

■

Encryption—Hide traffic contents to prevent unwanted disclosure to unauthorized or malicious individuals.

■

Firewalls—Filter network traffic to allow only valid traffic and services.

■

Vulnerability patching—Applies fixes or measures to stop the exploitation of known vulnerabilities. This includes turning off services that are not needed on every system; the fewer services that are enabled, the harder it is for hackers to gain access.

Note

Copyright  2002, Cisco Systems, Inc.

Also remember to implement physical security solutions to prevent unauthorized physical access to the network.

Network Security and the Cisco PIX Firewall

2-9

Monitor Security Secure

• Detects violations to the security policy • Involves system auditing Improve and real-time intrusion detection • Validates the security implementation in Step 1

© 2002, Cisco Systems, Inc.

Security Policy

Monitor

Test

www.cisco.com

CSPFA 2.1—2-9

Monitor the network for violations and attacks against the corporate security policy. These attacks can occur within the secured perimeter of the network— from a disgruntled employee or contractor—or from a source outside your trusted network. Monitoring the network should be done with a real-time intrusion detection device such as the Cisco Secure Intrusion Detection System (CSIDS). This assists you in discovering unauthorized entries, and also serves as a checkand-balance system for ensuring that devices implemented in Step 1 of the Security Wheel have been configured and are working properly.

2-10

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Test Security Validates effectiveness of the security policy through system auditing and vulnerability scanning

Secure

Improve

Security Policy

Monitor

Test

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-10

Validation is a must. You can have the most sophisticated network security system, but if it is not working, your network can be compromised. This is why you need to test the devices you implemented in Steps 1 and 2 to make sure they are functioning properly. The Cisco Secure Scanner is designed to validate your network security.

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-11

Improve Security • Use information from the monitor and test phases to make improvements to the security Improve implementation. • Adjust the security policy as security vulnerabilities and risks are identified.

© 2002, Cisco Systems, Inc.

www.cisco.com

Secure

Security Policy

Monitor

Test

CSPFA 2.1—2-11

The improvement phase of the Security Wheel involves analyzing the data collected during the monitoring and testing phases, and developing and implementing improvement mechanisms that feed into your security policy and the securing phase in Step 1. If you want to keep your network as secure as possible, you must keep repeating the cycle of the Security Wheel, because new network vulnerabilities and risks are created every day.

2-12

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Cisco AVVID and SAFE This section discusses Cisco Architecture for Voice, Video, and Integrated Data (AVVID) and SAFE.

Cisco AVVID Architecture Supply Chain

Customer Care

Internet Commerce

E-Learning

Workforce Optimization

Internet Business Integrators Messaging Internet Middleware Layer

Collaboration

Contact Center Multimedia

Video on Demand Personal Productivity

Voice Call Processing

Policy Management Security Content Distribution SLA Management Address Management

Intelligent Network Classification Accounting

Management

Caching

Real Time Services

DNS Services

Multicast

Load Balancing

Security

QoS

Intelligent Network Services

Network Platforms Clients © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-13

Cisco AVVID can be viewed as a framework to describe a network optimized for the support of Internet business solutions and as a best practice or roadmap for network implementation. This section discusses the various layers of the Cisco AVVID framework. The following are the different parts of the Cisco AVVID architecture: ■

Clients—The wide variety of devices that can be used to access the Internet business solutions through the network. These might include phones, PCs, PDAs, and so on. One key difference from traditional proprietary architectures is that the Cisco AVVID standards-based solution enables a wide variety of devices to be connected, even some not yet in broad use. Unlike traditional telephony and video solutions, proprietary access devices are not necessary. Instead, functionality is added through the intelligent network services provided in the infrastructure.

■

Network Platforms—The network infrastructure provides the physical and logical connection for devices, bringing them into the network. Network platforms are the LAN switches, routers, gateways, and other equipment that interconnect users and servers. Cisco network platforms are competitive for features, performance, and price, but their key capabilities are the integration and interaction with other elements of the Cisco AVVID framework. This layer of Cisco AVVID is the foundation for all applications that will be integrated to solve business problems.

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-13

■

Intelligent Network Services—The intelligent network services, provided through software that operates on network platforms, are a major benefit of an end-to-end architecture for deploying Internet business solutions. From quality of service (QoS) (prioritization) through security, accounting, and management, intelligent network services reflect the enterprise’s business rules and policies in network performance. A consistent set of the services end-to-end through the network is vital if the infrastructure is to be relied upon as a network utility. These consistent services enable new Internet business applications and e-business initiatives to rollout very quickly without a major re-engineering of the network each time. By contrast, networks built on best-of-breed strategies may promise higher performance in a specific device, but cannot be counted on to deliver these sophisticated features end-to-end in a multivendor environment. Cisco AVVID supports standards to provide for migration and the incorporation of Internet business integrators, but the added intelligent network services offered by an end-toend Cisco AVVID solution go far beyond what can be achieved in a best of breed environment.

■

Internet middleware layer—The next section, including service control and communication services, is a key part of any networking architecture, providing the software and tools to break down the barriers of complexity arising from new technology. These combined layers provide the tools for integrators and customers to tailor their network infrastructure and customize intelligent network services to meet application needs. These layers manage access, call setup and teardown, perimeter security, prioritization and bandwidth allocation, and user privileges. Software, such as distributed customer contact suites, messaging solutions, and multimedia and collaboration provide capabilities and a communication foundation that enable interaction between users and a variety of application platforms. In a best-of-breed strategy, many of these capabilities must be individually configured or managed. In traditional proprietary schemes, vendors dictated these layers, limiting innovation and responsiveness. Rapid deployment of Internet business solutions depends on consistent service control and communication services capabilities throughout the network. These capabilities are often delivered by Cisco from servers distributed throughout the network. The service control and communication services layers are the glue that joins the Internet technology layers of the Cisco AVVID framework with the Internet business solutions, in effect tuning the network infrastructure and intelligent network services to the needs of the Internet business solutions. In turn, the Internet business solutions are adapted for the best performance and availability on the network infrastructure by exploiting the end-to-end services available through the Cisco AVVID framework.

2-14

■

Internet business integrators—As part of the open ecosystem, it is imperative to enable partners with Cisco AVVID. Cisco realizes the crucial requirement to team with integrators, strategic partners, and customers to deliver complete Internet business. Cisco AVVID offers a guide for these interactions by describing a consistent set of services and capabilities that form a basis for many types of partner relationships.

■

Internet business solutions—Enterprise customers are deploying Internet business solutions to re-engineer their organizations. The applications associated with Internet business solutions are not provided by Cisco, but are

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

enabled, accelerated, and delivered through Cisco AVVID. The ability for companies to move their traditional business models to Internet business models and to deploy Internet business solutions is key to their survival. Cisco AVVID is the architecture upon which e-businesses build Internet business solutions that can be easily deployed and managed. Ultimately, the more Internet business solutions that are delivered, the more efficiently and effectively companies will increase productivity and added value.

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-15

Cisco AVVID Overview

• Cisco AVVID is the one enterprise architecture that provides the intelligent network infrastructure for today’s Internet business solutions. • As the industry’s only enterprise-wide, standardsbased network architecture, Cisco AVVID provides the roadmap for combining Cisco customers’ business and technology strategies into one cohesive model.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-14

The Internet is creating tremendous business opportunities for Cisco and Cisco customers. Internet business solutions such as e-commerce, supply chain management, e-learning, and customer care are dramatically increasing productivity and efficiency. Cisco AVVID is the one enterprise architecture that provides the intelligent network infrastructure for today’s Internet business solutions. As the industry’s only enterprise-wide, standards-based network architecture, Cisco AVVID provides the roadmap for combining customers’ business and technology strategies into one cohesive model.

2-16

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Cisco AVVID Benefits • Integration—By leveraging the Cisco AVVID architecture and applying the network intelligence inherent in IP, companies can develop comprehensive tools to improve productivity. • Intelligence—Traffic prioritization and intelligent networking services maximize network efficiency for optimized application performance. • Innovation—Customers have the ability to adapt quickly in a changing business environment. • Interoperability—Standards-based APIs enable open-integration with third-party developers, providing customers with choice and flexibility.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-15

With Cisco AVVID, customers have a comprehensive roadmap for enabling Internet business solutions and creating a competitive advantage. There are four Cisco AVVID benefits: ■

Integration—By leveraging the Cisco AVVID architecture and applying the network intelligence inherent in IP, companies can develop comprehensive tools to improve productivity.

■

Intelligence—Traffic prioritization and intelligent networking services maximize network efficiency for optimized application performance.

■

Innovation—Customers have the ability to adapt quickly in a changing business environment.

■

Interoperability—Standards-based application programming interfaces (APIs) enable open-integration with third-party developers, providing customers with choice and flexibility.

Combining the network infrastructure and services with new-world applications, Cisco AVVID accelerates the integration of technology strategy with business vision.

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-17

SAFE Blueprint Overview • Building on Cisco AVVID, the SAFE framework provides a secure migration path for companies to implement converged voice, video, and data networks. • SAFE is a flexible framework that empowers companies to securely, reliably, and cost-effectively take advantage of the Internet economy. • SAFE integrates scalable, high performance security services throughout the e-business infrastructure. • SAFE is enhanced by a rich ecosystem of products, partners, and services that enable companies to implement secure e-business infrastructures today.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-16

SAFE is a flexible, dynamic security blueprint for networks, which is based on Cisco AVVID. SAFE enables businesses to securely and successfully take advantage of e-business economies and compete in the Internet economy. As the leader in networking for the Internet, Cisco is ideally positioned to help companies secure their networks. The SAFE blueprint, in conjunction with an ecosystem of best-of-breed, complementary products, partners, and services, ensures that businesses can deploy robust, secure networks in the Internet age.

2-18

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

SAFE Benefits • Provides a proven, detailed blueprint to securely compete in the Internet economy • Provides the foundation for migrating to secure, cost-effective, converged networks • Enables organizations to stay within their budgets by deploying a modular, scalable security framework in stages • Delivers protection at every access point to the network through best-in-class security products and services

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-17

There are several major benefits in implementing the SAFE blueprint for secure e-business: ■

Provides the foundation for migrating to secure, affordable, converged networks

■

Enables companies to cost-effectively deploy a modular, scalable security framework in stages

■

Delivers integrated network protection via high-level security products and services

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-19

SAFE Modular Blueprint Enterprise campus

Enterprise edge

Service provider edge

E-commerce

ISP B

Corporate Internet

ISP A

VPN and remote access

PSTN

WAN

Frame or ATM

Building

Building distribution

Edge distribution

Management Core Server

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-18

The SAFE Blueprint provides a robust security blueprint that builds on Cisco AVVID. SAFE layers are incorporated throughout the Cisco AVVID infrastructure: ■

Infrastructure layer—Intelligent, scalable security services in Cisco platforms, such as routers, switches, firewalls, intrusion detection systems, and other devices

■

Appliances layer—Incorporation of key security functionality in mobile hand-held devices and remote PC clients

■

Service control layer—Critical security protocols and APIs that enable security solutions to work together cohesively

■

Applications layer—Host- and application-based security elements that ensure the integrity of critical e-business applications

To facilitate rapidly deployable, consistent security throughout the enterprise, SAFE consists of modules that address the distinct requirements of each network area. By adopting a SAFE blueprint, security managers do not need to redesign the entire security architecture each time a new service is added to the network. With modular templates, it is easier and more cost-effective to secure each new service as it is needed and to integrate it with the overall security architecture. One of the unique characteristics of the SAFE blueprint is that it is the first industry blueprint that recommends exactly which security solutions should be included in which sections of the network, and why they should be deployed. Each module in the SAFE blueprint is designed specifically to provide maximum performance for e-business, while at the same time enabling enterprises to maintain security and integrity.

2-20

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

SAFE Blueprint and Ecosystem Secure e-commerce

Secure supply chain management

$

Solutions Secure intranet for workforce optimization

Ecosystem

Integration partners Security Associate solutions Cisco programs and services

Directory Directory

Service control control Service Infrastructure Infrastructure Appliances or or clients clients Appliances

© 2002, Cisco Systems, Inc.

www.cisco.com

Operations Operations

Applications Applications

Cisco AVVID system architecture CSPFA 2.1—2-19

Cisco has opened its Cisco AVVID architecture and SAFE blueprint to key thirdparty vendors to create a security solutions ecosystem to spur development of best-in-class multiservice applications and products. The Cisco AVVID architecture and SAFE blueprint provide interoperability for third-party hardware and software using standards-based media interfaces, APIs, and protocols. This ecosystem is offered through the Security and Virtual Private Network (VPN) Associate Program, an interoperability solutions program that provides Cisco customers with tested and certified, complementary products for securing their businesses. The ecosystem enables businesses to design and roll out secure networks that best fit their business model and enable maximum agility.

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-21

Cisco AVVID Partner Program Security and VPN Products SECURE CONNECTIVITY

APPLICATION SECURITY

Wired and Wireless VPNs

Host and Server Protection

PERIMETER SECURITY

IDENTITY Strong Authentication, PKI

Content Filtering; Personal Firewall

Interoperability and

CoCo-existence with

Cisco Security and VPN Products

SECURITY MANAGEMENT and MONITORING © 2002, Cisco Systems, Inc.

Event logging, Reporting, and Analysis www.cisco.com

CSPFA 2.1—2-20

The Security and VPN Solutions Set within the Cisco AVVID Partner Program is an interoperability solutions program developed to deliver comprehensive security and VPN solutions for Cisco networks to Cisco customers. This program is a key component of the SAFE strategy in that it provides a rich ecosystem of products, partners, and services that empowers companies to securely, reliably, and cost-effectively take advantage of the Internet Economy. The program provides the assurance that security solutions making up Partner products have been tested and verified to be interoperable with Cisco security products, and add distinct value to Cisco networks. The goal is to enable Cisco customers to securely take advantage of the expanding e-business marketplace. The security and VPN solutions created through this interoperability program are focused on critical business applications such as e-commerce, secure remote access, intranets, extranets, and supply-chain integration and management. As a result, the solutions categories currently targeted in the program include those that customers continue to request and deploy in their networks:

2-22

■

Identity solutions—Include authentication, authorization, and Public Key Infrastructure (PKI) solutions such as smart cards, hard and soft tokens, authentication servers, and Certificate Authority (CA) servers

■

Application security solutions—Include products such as server and host protection applications

■

Perimeter security solutions—Include products such as URL filtering applications, e-mail, and virus scanning applications

■

Security management and monitoring solutions—Include products that support Syslog reporting, event analysis, reporting, and secure remote administration

■

Secure connectivity solutions—Include products such as VPN client software and wireless VPN products

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Cisco AVVID Partner Program Security and VPN Services APPLICATION and CODE REVIEW

POLICY and PROCEDURE

Security Services Compatible with

Cisco Security Solution

OUTSOURCE MONITORING and MANAGEMENT © 2002, Cisco Systems, Inc.

INCIDENT RESPONSE www.cisco.com

CSPFA 2.1—2-21

The security services offered through the AVVID Partner Program are focused on specific areas of security services available in the industry. As a result, the services categories currently targeted include those that customers continue to request and deploy in their organizations: ■

Application and code review—Examines and analyzes security structure and vulnerabilities of hardware and software systems

■

Outsourced monitoring and management—Provides third-party management, monitoring of security infrastructure with incident notification, or both

■

Policy and procedures—Provides assistance with reviewing and building robust and effective security policies and practices

■

Incident response—Responds to and mitigates attacks on systems and networks

Copyright  2002, Cisco Systems, Inc.

Network Security and the Cisco PIX Firewall

2-23

Cisco AVVID Partner Program Security and VPN Services (cont.) BUSINESS IMPACT and RISK ASSESSMENT

COMPETITIVE COUNTER-INTELLIGENCE

Security Services Compatible with

Cisco Security Solution

VULNERABILITY ASSESSMENT © 2002, Cisco Systems, Inc.

2-24

DESIGN and IMPLEMENTATION www.cisco.com

CSPFA 2.1—2-22

■

Business impact and risk assessment—Correlates the security state of the network to impact on broad business processes

■

Vulnerability assessment—Provides proactive audit and analysis of the current security state of a system or network

■

Competitive counter-intelligence—Assesses the vulnerability to compromise from knowledge-based attacks

■

Design and implementation—Provides assistance with the architecture, design, and implementation of security products and technologies

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

CCO Links

• www.cisco.com/go/avvid • www.cisco.com/go/safe • www.cisco.com/go/avvidpartners • www.cisco.com/warp/public/779/largeent/ partner/esap/secvpn.html

© 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—2-23

Network Security and the Cisco PIX Firewall

2-25

Summary This section summarizes the information you learned in this chapter.

Summary • Network security is essential because networked computers are accessible and vulnerable from any computer in the world. • There are four primary threats to network security: unstructured, structured, external, and internal threats. • There are three types of network attacks: reconnaissance, access, and denial of service attacks. • The Security Wheel is the graphical representation of security as a continuous process. • Cisco AVVID is a standards-based enterprise architecture that accelerates the integration of business and technology strategies. • Cisco SAFE, which is based on Cisco AVVID, is a flexible, dynamic security blueprint for networks. © 2002, Cisco Systems, Inc.

2-26

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—2-25

Copyright  2002, Cisco Systems, Inc.

3

Cisco PIX Firewall Models and Features

Overview This chapter includes the following topics: ■

Objectives

■

Firewalls

■

Overview of the PIX Firewall

■

Summary

Objectives This section lists the chapter’s objectives.

Objectives Upon completion of this chapter, you will be able to perform the following tasks: • Describe firewall technologies and define the three types of firewalls used to secure today’s computer networks. • Describe the PIX Firewall. • Identify the PIX Firewall models. • Describe the PIX Firewall features and functions.

© 2002, Cisco Systems, Inc.

3-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—3-2

Copyright  2002, Cisco Systems, Inc.

Firewalls This section provides an explanation of a firewall.

What Is a Firewall?

A firewall is a system or group of systems that manages access between two networks.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-4

By conventional definition, a firewall is a partition made of fireproof material designed to prevent the spread of fire from one part of a building to another. It can also be used to isolate one compartment from another. When applying the term firewall to a computer network, a firewall is a system or group of systems that enforces an access control policy between two or more networks.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Models and Features

3-3

Firewall Technologies Firewall operations are based on one of three technologies: • Packet filtering • Proxy server • Stateful packet filtering

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-5

Firewall operations are based on one of three technologies:

3-4

■

Packet filtering—Limits information into a network based on static packet header information.

■

Proxy server—Requests connections between a client on the inside of the firewall and the Internet.

■

Stateful packet filtering—Combines the best of packet filtering and proxy server technologies.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Packet Filtering Limits information into a network based on destination and source address

ACL

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-6

A firewall can use packet filtering to limit information entering a network, or information moving from one segment of a network to another. Packet filtering uses access control lists (ACLs), which allow a firewall to accept or deny access based on packet types and other variables. This method is effective when a protected network receives a packet from an unprotected network. Any packet that is sent to the protected network and does not fit the criteria defined by the ACLs is dropped. But there are problems with packet filtering: ■

Arbitrary packets can be sent that fit the ACL criteria and, therefore, pass through the filter.

■

Packets can pass through the filter by being fragmented.

■

Complex ACLs are difficult to implement and maintain correctly.

■

Some services cannot be filtered.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Models and Features

3-5

Proxy Server Requests connections between a client on the inside of the firewall and the Internet

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-7

A proxy server is a firewall device that examines packets at higher layers of the Open Systems Interconnection (OSI) model. This device hides valuable data by requiring users to communicate with a secure system by means of a proxy. Users gain access to the network by going through a process that establishes session state, user authentication, and authorized policy. This means that users connect to outside services via application programs (proxies) running on the gateway connecting to the outside unprotected zone. However, there are problems with the proxy server because it

3-6

■

Creates a single point of failure, which means that if the entrance to the network is compromised, then the entire network is compromised.

■

Is difficult to add new services to the firewall.

■

Performs slower under stress.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Stateful Packet Filtering Limits information into a network based not only on destination and source address, but also on packet data content © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-8

Stateful packet filtering is the method used by the Cisco PIX Firewall. This technology maintains complete session state. Each time a TCP/UDP connection is established for inbound or outbound connections, the information is logged in a stateful session flow table. The stateful session flow table contains the source and destination addresses, port numbers, TCP sequencing information, and additional flags for each TCP/UDP connection associated with that particular session. This information creates a connection object and, consequently, all inbound and outbound packets are compared against session flows in the stateful session flow table. Data is permitted through the firewall only if an appropriate connection exists to validate its passage. This method is effective because: ■

It works on packets and connections.

■

It operates at a higher performance level than packet filtering or using a proxy server.

■

It records data in a table for every connection or connectionless transaction. This table serves as a reference point to determine if packets belong to an existing connection or are from an unauthorized source.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Models and Features

3-7

Overview of the PIX Firewall This section discusses the basic concepts of the PIX Firewall.

PIX Firewall—What Is it? Stateful firewall with high security and fast performance • Secure, real-time, embedded operating system— no UNIX or NT security holes • Adaptive security algorithm provides stateful security • Cut-through proxy eliminates application-layer bottlenecks • AMD SC520 (501), Pentium MMX (506), Pentium Pro (515), Pentium II (520), or Pentium III (525 and 535) processor-based system © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-10

The Private Internet Exchange (PIX) Firewall is a key element in the overall Cisco end-to-end security solution. The PIX Firewall is a dedicated hardware and software security solution that delivers high-level security without impacting network performance. It is a hybrid system because it uses features from both the packet filtering and proxy server technologies. Unlike typical CPU-intensive, full-time proxy servers that perform extensive processing on each data packet at the application level; the PIX Firewall uses a proprietary operating system that is a secure, real-time, embedded system. The PIX Firewall provides the following benefits and features:

3-8

■

Non-UNIX, secure, real-time, embedded system—Unlike typical CPUintensive proxy servers that perform extensive processing on each data packet, the PIX Firewall uses a secure, real-time, embedded system, which enhances the security of the network.

■

Adaptive Security Algorithm (ASA)—Implements stateful connection control through the PIX Firewall.

■

Cut-through proxy—A user-based authentication method of both inbound and outbound connections, providing improved performance in comparison to that of a proxy server.

■

Stateful failover—The PIX Firewall enables you to configure two PIX Firewall units in a fully redundant topology.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

■

Stateful packet filtering—A secure method of analyzing data packets that places extensive information about a data packet into a table. For a session to be established, information about the connection must match the information in the table.

The PIX Firewall is interoperable and scalable with IPSec, which includes an umbrella of security and authentication protocols such as Internet Key Exchange (IKE) and Public Key Infrastructure (PKI). The PIX Firewall offers an IPSecbased virtual private network (VPN). Remote clients can securely access corporate networks through their ISPs.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Models and Features

3-9

PIX Firewall Family

Price

PIX 535

PIX 525 PIX 515

PIX 506

Gigabit Ethernet

PIX 501

SOHO

ROBO

SMB

Enterprise

SP

Functionality © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-11

The Cisco PIX Firewall 500 series scales to meet a range of requirements and network sizes, and currently consists of five models: the PIX Firewall 501, 506, 515, 525, and 535. The 500 series models support a broad range of network interface cards (NIC). The 501 has an integrated 10BaseT port and an integrated 4-port 10/100 switch. The 506 has dual integrated 10Base-T ports. The 515 supports single or four-port 10/100 Ethernet cards and the VPN Accelerator card. The PIX Firewall 525 supports single-port or four-port 10/100 Fast Ethernet, Gigabit Ethernet, and the VPN Accelerator. The 535 supports Fast Ethernet, Gigabit Ethernet and the VPN Accelerator. The PIX Firewall is secure right out of the box. The PIX Firewall default settings allow all connections from the inside interface access to the outside interface, and block all connections from the outside interface to the inside interface. After a few installation procedures and an initial configuration of six general commands, your PIX Firewall is operational and protecting your network.

3-10

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

PIX Firewall 501 • Designed for small offices and teleworkers • 3,500 simultaneous connections • 10 Mbps cleartext throughput • 133 MHz processor • 16 MB of SDRAM • Supports 1 10BaseT Ethernet interface (outside) and a 4-port 10/100 switch (inside) • 3 Mbps 3DES throughput • 5 simultaneous VPN peers

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-12

. Hz AM

The Cisco PIX 501 Firewall measures only 1.0 x 6.25 x 5.5 inches and weighs only 0.75 pounds, yet it delivers enterprise-class security for small offices and teleworkers. Ideal for securing high-speed "always on" broadband environments, the Cisco PIX 501 Firewall provides small office networking features and powerful remote management capabilities in a compact, all-in-one solution. The Cisco PIX 501 Firewall provides a convenient way for multiple computers to share a single broadband connection. In addition to its RS-232 (RJ-45) 9600 baud console port and its integrated 10BaseT port for the outside interface, it features an integrated auto-sensing, auto-MDIX 4-port 10/100 switch for the inside interface. Auto-MDIX support eliminates the need to use crossover cables with devices connected to the switch. The PIX Firewall 501 can also secure all network communications from remote offices to corporate networks across the Internet using its standards-based Internet Key Exchange (IKE)/IP security (IPsec) VPN capabilities. Users can also enjoy plug-and-play networking by taking advantage of the built-in Dynamic Host Configuration Protocol (DHCP) server within the PIX Firewall, which automatically assigns network addresses to the computers when they are powered on. The PIX Firewall 501 comes with an integrated security lock slot for improved physical security and contains 8 MB of Flash memory. Note

The cable lock for the security lock slot is not provided with the unit.

Note

The Cisco PIX 501 Firewall requires software version 6.1(1) or higher.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Models and Features

3-11

PIX Firewall 506 • Designed for small and remote offices • 10,000 simultaneous connections • 20 Mbps cleartext throughput • 200 MHz processor • 32 MB RAM • Supports 2 interfaces (10BaseT) • 10 Mbps 3DES throughput • 25 simultaneous VPN peers

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-13

The PIX Firewall 506 is designed for companies that are leveraging the cost advantages of the Internet and allowing employees to work remotely. It delivers full firewall protection, as well as IPSec virtual private network (VPN) capabilities. The 506 can connect with up to 25 VPN peers simultaneously, and provides users with a complete implementation of IPSec standards. It comes with 8 MB of Flash memory and 2 integrated 10Base-T ports, is compact in size (8 x 12 x 1.7"), and uses TFTP for image download and upgrade.

3-12

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

PIX Firewall 515 • Designed for small to medium businesses • 128,000 simultaneous connections • 147 Mbps cleartext throughput • 200 MHz processor • 64 MB RAM • Supports 6 interfaces • Supports failover • 10 Mbps 3DES throughput

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-14

The PIX Firewall 515 is designed for small and medium-sized businesses. It delivers full firewall protection, as well as IPSec VPN capabilities with complete implementation of IPSec standards. You can create and terminate VPN tunnels between two PIX Firewalls, between a PIX Firewall and any Cisco VPN-enabled router, and between a PIX Firewall and the Cisco Virtual Private Networks (CVPN) Client. The PIX Firewall 515 is also ideal for remote sites that require only two-way communication with their corporate network. The PIX Firewall 515 supports up to six 10/100 Ethernet ports, as well as the VPN Accelerator card. This allows for more robust traffic configurations as well as establishing a protected DMZ for hosting a web site or performing URL filtering and virus detection. The PIX Firewall 515 is rack-mountable, comes with 16 MB of Flash memory, and uses TFTP for image download and upgrade. Note

Copyright  2002, Cisco Systems, Inc.

A PIX Firewall 515-UR license is required for support of six interfaces. The 515-R license supports three interfaces.

Cisco PIX Firewall Models and Features

3-13

PIX Firewall 520 • Designed for enterprise • 256,000 simultaneous connections • 240 Mbps cleartext throughput • 350 MHz processor • 128 MB RAM • Supports 6 interfaces • Supports failover • 20 Mbps 3DES throughput

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-15

The PIX Firewall 520 is intended for large enterprise organizations and complex, high-end traffic environments. It too delivers full firewall protection, as well as IPSec VPN capabilities with complete implementation of IPSec standards. The 520 has an enterprise chassis design, is rack-mountable, and uses a 3.5-inch floppy disk drive to upgrade and load the image. Although newer PIX Firewall 520 units come with 16 MB of Flash memory, older units have only 2 MB. To run software versions 5.2 and higher, the Flash needs to be upgraded to 16 MB. Note

3-14

The PIX 520 Firewall is no longer available for purchase. The information on the 520 remains in the course as a courtesy to our customers. The recommended replacement product for the PIX 520 Firewall is the 525.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

PIX Firewall 525 • Designed for enterprise • 280,000 simultaneous connections • 360 Mbps cleartext throughput • 600 MHz processor • 256 MB RAM • Supports 8 interfaces • Supports failover • 70 Mbps 3DES throughput

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-16

The PIX Firewall 525 is intended for Enterprise and Service Provider use. Ideal for protecting the Enterprise Headquarters’ perimeter, the PIX Firewall 525 delivers full firewall protection, as well as IPSec VPN capabilities. The PIX Firewall 525 supports a broad range of network interface cards. Standard cards include single-port or four-port 10/100 Fast Ethernet and Gigabit Ethernet (with UR license). With the restricted license, it supports 6 interfaces; with the unrestricted license (UR), it supports 8 interfaces. The PIX Firewall 525 also offers multiple power supply options. You can choose between AC and a 48 DC power supply. Either option can be paired with a second power supply for redundancy and high-availability. Note

Copyright  2002, Cisco Systems, Inc.

The PIX 525 Firewall also supports the VPN Accelerator.

Cisco PIX Firewall Models and Features

3-15

PIX Firewall 535 • Designed for enterprise and service providers • 500,000 simultaneous connections • 1.7 Gbps cleartext throughput • 1 GHz processor • 1 GB RAM • Maximum of 10 interfaces • Supports failover • 96 Mbps 3DES throughput

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-17

The PIX Firewall 535 is intended for Enterprise and Service Provider use. It has a throughput of 1.7 Gbps with the ability to handle up to 500,000 concurrent connections. Supporting both site-to-site and remote access VPN applications via 56-bit DES or 168-bit 3DES, the integrated VPN functionality of the PIX Firewall 535 can be supplemented with a VPN Accelerator card to deliver 96 Mbps of 3DES throughput and 2,000 IPSec tunnels. The PIX Firewall 535 supports Fast Ethernet, Gigabit Ethernet, and VPN Accelerator interfaces. A PIX Firewall 535 configured with only Gigabit interfaces will not be capable of upgrading an Activation key. Activation key upgrades require the monitor mode for all systems without floppy disk drives. The monitor mode does not support Gigabit interfaces. A Fast Ethernet interface must be installed to use the monitor mode. If a PIX Firewall 535 is ordered with Gigabit interfaces only, an additional Fast Ethernet interface is included with the unit so that the Activation key may be upgraded. Note

If, after configuring a PIX Firewall unit for Gigabit Ethernet cards, you replace the cards with 10/100 Ethernet cards, the order of the cards in the configuration changes from what you originally configured. For example, if you configure ethernet0 for a Gigabit Ethernet card assigned to the inside interface and replace this card with a 10/100 Ethernet card, the card may no longer appear as ethernet0.

The PIX Firewall 535 comes with 16 MB of Flash memory and supports the PIX Firewall software version 5.3 or later.

3-16

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Finesse Operating System Eliminates the risks associated with general-purpose operating systems

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-18

Finesse, Cisco’s proprietary operating system is a non-UNIX, non-Windows NT, IOS-like operating system. Use of Finesse eliminates the risks associated with the general-purpose operating systems. It enables the PIX Firewall to deliver outstanding performance with up to 500,000 simultaneous connections— dramatically greater than any UNIX-based firewall.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Models and Features

3-17

Adaptive Security Algorithm • Provides “stateful” connection security • Tracks source and destination ports and addresses, TCP sequences, and additional TCP flags • TCP sequence numbers are randomized • Tracks UDP and TCP session state • Connections allowed out—allows return session back flow (TCP ACK bit) • Supports authentication, authorization, and Syslog accounting © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-19

The heart of the PIX Firewall is the Adaptive Security Algorithm (ASA). ASA maintains the secure perimeters between the networks controlled by the firewall. The stateful, connection-oriented ASA design creates session flows based on source and destinations addresses. It randomizes TCP sequence numbers, port numbers, and additional TCP flags before completion of the connection. This function is always in operation, monitoring return packets to ensure they are valid, and allows one-way (inside to outside) connections without an explicit configuration for each internal system and application. The randomizing of the TCP sequence numbers is to minimize the risk of a TCP sequence number attack. Because of the ASA, the PIX Firewall is less complex and more robust than a packet filtering-designed firewall. Stateful packet filtering is a secure method of analyzing data packets that places extensive information about a data packet into a table. Each time a TCP connection is established for inbound or outbound connections through the PIX Firewall, the information about the connection is logged in a stateful session flow table. For a session to be established, information about the connection must match information stored in the table. With this methodology, the stateful filters work on the connections and not the packets, making it a more stringent security method with its sessions immune to hijacking. Like a fingerprint, stateful packet filtering

3-18

■

Obtains the session identifying parameters, IP addresses, and ports for each TCP connection.

■

Logs the data in a stateful session flow table and creates a session object.

■

Compares the inbound and outbound packets against session flows in the connection table.

■

Allows data packets to flow through the PIX Firewall only if an appropriate connection exists to validate their passage.

■

Temporarily sets up a connection object until the connection is terminated.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Cut-Through Proxy Operation 1. The user makes a request to an IS resource.

Internal/ external user 3.

2. The PIX Firewall intercepts the connection. 3. The PIX Firewall prompts the user for a username and password, authenticates the user, and checks the security policy on a RADIUS or TACACS+ server. IS resource

Username and Password Required

PIX Firewall

Enter username for CCO at www.com

User Name:

student

Password:

123@456 OK

Cisco Secure

Cancel

4. The PIX Firewall initiates a connection from the PIX Firewall to the destination IS resource. 5. The PIX Firewall directly connects the internal or external user to the IS resource via ASA.

Authenticates once at the application layer (OSI Layer 7) for each supported service Connection is passed back to the PIX Firewall high-performance ASA engine, while maintaining session state © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-20

Cut-through proxy is a method of transparently verifying the identity of the users at the firewall, and permitting or denying access to any TCP- or UDP-based applications. This is also known as user-based authentication of inbound or outbound connections. Unlike a proxy server that analyzes every packet at the application layer of the OSI model, the PIX Firewall first challenges a user at the application layer. After the user is authenticated and the policy is checked, the PIX Firewall shifts the session flow to a lower layer of the OSI model for dramatically faster performance. This allows security policies to be enforced on a per-user-identification basis. Connections must be authenticated with a user identification and password before they can be established. The user identification and password is entered via an initial HTTP, Telnet, or FTP connection. This method eliminates the price performance impact that UNIX system-based firewalls impose in similar configurations, and allows a finer level of administrative control over connections. The cut-through proxy method of the PIX Firewall also leverages the authentication and authorization services of the Cisco Secure Access Control Server.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Models and Features

3-19

Stateful Failover 172.26.26.0 /24

Internet

.50

Backbone, web, FTP, and TFTP server .1

192.168.0.0 /24 Failover cable

e0 .2 Primary PIX Firewall e1 .1

e3 .1

e0 .7 172.17.0.0 /24 e3 .7 Secondary PIX Firewall

e2 .1

e2 .7 e1 .7

172.16.0.0/24

.2 DMZ

10.0.0.0 /24 .3

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-21

Stateful failover provides a mechanism for the PIX Firewall to be redundant by allowing two identical units to serve the same functionality. The active unit performs normal security functions, while the standby unit monitors, ready to take control should the active unit fail. The two units must be running the same version of software. Configuration replication will occur under the following circumstances: ■

When a secondary unit completes its initial bootup, the primary unit will replicate its entire configuration to the secondary unit.

■

As commands are entered on the primary unit, they are sent across to the secondary unit. The commands are sent via failover cable.

■

Entering the write standby command on the primary unit forces the entire configuration to the secondary unit.

Because configuration replication is automatic from the active unit to the standby unit, configuration should be modified only on the active unit. When failover occurs, Syslog messages are generated indicating the cause of failure. Failover detection occurs within 30 to 45 seconds. Note

3-20

PIX Firewall models 515, 525, and 535 support failover.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Summary This section summarizes the information you learned in this chapter.

Summary • There are three firewall technologies: packet filtering, proxy server, and stateful packet filtering. • There are currently five PIX Firewall models in the 500 series: 501, 506, 515, 525, and 535. • The PIX Firewall features include: Finesse operating system, Adaptive Security Algorithm, cut-through proxy, stateful failover, and stateful packet filtering.

© 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—3-23

Cisco PIX Firewall Models and Features

3-21

3-22

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

4

Identify the Cisco PIX Firewall

Overview This chapter includes the following topics: ■

Objectives

■

Identify the PIX Firewall 501 controls, connectors, and LEDs

■

Identify the PIX Firewall 506 controls, connectors, and LEDs

■

Identify the PIX Firewall 515 controls, connectors, and LEDs

■

Identify the PIX Firewall 520 controls, connectors, and LEDs

■

Identify the PIX Firewall 525 controls, connectors, and LEDs

■

Identify the PIX Firewall 535 controls, connectors, and LEDs

■

Summary

Objectives This section lists the chapter’s objectives:

Objectives

Upon completion of this chapter, you will be able to perform the following tasks: • Identify the PIX Firewall 501, 506, 515, 520, 525, and 535 controls, connectors, and LEDs. • Identify the PIX Firewall 501, 506, 515, 520, 525, and 535 interfaces.

© 2002, Cisco Systems, Inc.

4-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—4-2

Copyright  2002, Cisco Systems, Inc.

Identify the PIX Firewall 501 Controls and Connectors This section explains the controls and connectors for the PIX Firewall 501.

The PIX Firewall 501 Front Panel LEDs Power Power

Link/Act Link/Act 100MBPS 100MBPS

VPN VPN Tunnel Tunnel

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—4-4

The following are the LEDs: ■

Power—When the light is green, the device is powered on.

■

Link/Act—When the light is flashing green, network activity (such as Internet access, is present). When the light is green, the correct cable is in use and the connected equipment has power and is operational. When the light is off, no link is established.

■

VPN Tunnel—When the light is green, one or more IKE/IPSec VPN tunnels are established. When the light is off, one or more IKE/IPSec VPN tunnels are disabled. If the standard configuration has not been modified to support VPN tunnels, the LED does not light up because it is disabled by default.

Note ■

Copyright  2002, Cisco Systems, Inc.

The VPN Tunnel LED does not light up when PPTP/L2TP tunnels are established.

100MBPS—When the light is green, the interface is enabled at 100 Mbps (auto-negotiated). When the light is off, the interface is enabled at 10 Mbps.

Identify the Cisco PIX Firewall

4-3

PIX Firewall 501 Back Panel Console Console port port (RJ-45) (RJ-45)

4-port 4-port 10/100 10/100 switch switch (RJ-45) (RJ-45)

10BaseT 10BaseT (RJ-45) (RJ-45)

© 2002, Cisco Systems, Inc.

www.cisco.com

Security Security lock lock slot slot

Power Power connector connector

CSPFA 2.1—4-5

This figure shows the back panels of the PIX Firewall 501. The following are the PIX Firewall 501 features: ■

10/100 switch ports—Ports in the auto-sensing, auto-MDIX switch used for the inside interface. Connect your PC or other network devices to one of the four switched ports, which are numbered 1 through 4.

■

10BaseT port—Port 0, a half-duplex Ethernet port for the public network. The PIX 501 Firewall comes with a yellow Ethernet cable (72-1482-01) and an orange Ethernet cable (72-3515-01). Use the yellow cable to connect the device to a switch or hub. Use the orange cable to connect the device to a DSL modem, cable modem, or router.

■

Console port—RS-232 (RJ-45) 9600 baud port used to connect a computer to the PIX Firewall for console operations.

■

Power connector—Used to attach the power supply cable to the PIX Firewall. The PIX 501 does not have a power switch.

■

Security lock slot— A slot that accepts standard desktop cable locks to provide physical security for small portable equipment, such as laptop computers.

Note

4-4

When installing the PIX 501 Firewall, place the chassis on a flat, stable surface. The chassis is not rack mountable.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Identify the PIX Firewall 506 Controls and Connectors This section explains the controls and connectors for the PIX Firewall 506.

The PIX Firewall 506 Front Panel LEDs

Network Network LED LED

Power Power LED LED

Active Active LED LED

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—4-7

The following are the LEDs: ■

POWER—When the PIX Firewall has power, the light shines.

■

ACT—When the software image has been loaded on the PIX Firewall 506 unit, the light shines.

■

NETWORK—When at least one network interface is passing traffic, the light shines.

Copyright  2002, Cisco Systems, Inc.

Identify the Cisco PIX Firewall

4-5

PIX Firewall 506 Back Panel

ACT(ivity) ACT(ivity) LED LED

ACT(ivity) LED LINK LED

10BaseT (RJ-45)

© 2002, Cisco Systems, Inc.

LINK LED

10BaseT (RJ-45)

Power switch

USB port Console Port (RJ-45)

www.cisco.com

CSPFA 2.1—4-8

On the PIX Firewall 506, Ethernet 1 connects the inside network and Ethernet 0 is for the outside network. Use the console port to connect a computer to enter configuration commands. The USB port to the left of the console port is not used. The power connection is directly beneath the power switch. The PIX Firewall 506 uses an external AC to DC power supply. The LEDs display the following transmission states:

4-6

■

ACT—Shows network activity.

■

LINK—Shows that data is passing on the network to which the connector is attached.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Identify the PIX Firewall 515 Controls and Connectors This section explains the controls and connectors for the PIX Firewall 515.

The PIX Firewall 515 Front Panel LEDs

Power Power LED LED

Network Network LED LED

Active Active Failover Failover Unit Unit

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—4-10

The following are the LEDs: ■

Power—When the PIX Firewall has power, the light shines.

■

ACT—When the PIX Firewall is used in a standalone configuration, the light shines. When the PIX Firewall is configured for failover operations, the light shines on the active PIX Firewall.

■

Network—The light shines when at least one network interface is passing traffic.

Copyright  2002, Cisco Systems, Inc.

Identify the Cisco PIX Firewall

4-7

The PIX Firewall 515 100 Mbps LED LINK LINK LED LED

100 Mbps LED FDX LED

10/100BaseTX Ethernet 1 (RJ-45)

© 2002, Cisco Systems, Inc.

LINK LED

Failover connector FDX LED

10/100BaseTX Ethernet 0 (RJ-45)

Console port (RJ-45)

www.cisco.com

Power switch

CSPFA 2.1—4-11

This figure shows the back panels of the PIX Firewall 515. The following lists the PIX Firewall 515 features: ■

Ethernet connections—With software versions 5.2 and higher, any port, whether fixed or a PCI expansion port, and any interface type, FDDI, Token Ring, Fast Ethernet, or Gigabit Ethernet, can be assigned to be the inside or outside network port.

■

Console port—Used to connect a computer to the PIX Firewall for console operations.

■

Failover connection—Used to attach a failover cable between two PIX Firewalls.

■

100 Mbps LED—100 Mbps, 100-baseTX communication for the respective connector. If the light is off, the PIX Firewall 515 uses 10 Mbps data exchange.

■

LINK LED—Indicates that data is passing on the network to which the connector is attached.

■

FDX LED—Indicates that the connection uses full duplex data exchange— data can be transmitted and received simultaneously. If the light is off, half duplex is in effect.

■

Power switch—Controls the power to the PIX Firewall.

Note

4-8

The USB port to the left of the console port and the detachable plate above the Ethernet 1 connector are for future PIX Firewall enhancements.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

PIX Firewall 515 Quad Card

Using the quad card requires the PIX Firewall 515-UR license.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—4-12

The quad card is a four-part Ethernet card. When you connect the perimeter network cables to this card, you begin with the far left connector and move to the right. For example, Ethernet 2 will go in the far left connector, Ethernet 3 in the second connector from the left, and so on. Note

Copyright  2002, Cisco Systems, Inc.

The maximum number of interfaces allowed is six. Any additional cards are not recognized.

Identify the Cisco PIX Firewall

4-9

PIX Firewall 515 Two Single-Port Connectors

Using two single-port connectors requires the PIX Firewall 515-UR license.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—4-13

If your PIX Firewall has one or two single-port Ethernet cards installed in the auxiliary assembly on the left of the PIX Firewall at the rear, the cards are numbered top to bottom so that the top card is Ethernet 2 and the bottom card is Ethernet 3.

4-10

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Identify the PIX Firewall 520 Controls and Connectors This section explains the controls and connectors for the PIX Firewall 520.

The PIX Firewall 520

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—4-15

The PIX Firewall 520 cable connectors are in the front of the PIX Firewall; earlier models connect at the rear. The PIX Firewall 520 comes with a 3.5-inch floppy disk drive with the power switch on the rear panel. Two rack-unit spaces are needed to mount a PIX Firewall 520.

Copyright  2002, Cisco Systems, Inc.

Identify the Cisco PIX Firewall

4-11

PIX Firewall 520 Four Single-Port Connectors

Console connector Failover connector Perimeter network 2 (optional) Perimeter network 1 (optional) Inside network Outside network

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—4-16

This figure represents the front of the PIX Firewall 520 and shows the placement of each single-port connector. When connecting cables with four single-port interfaces on the PIX Firewall, the outside interface card must be in slot 0—the farthest left available slot in the PIX Firewall. The first card to the right of the outside interface is seen by the PIX Firewall as the inside interface card, regardless of location. Note

4-12

The PIX Firewall supports six interfaces.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

PIX Firewall 520 Quad Card Connector

Perimeter 3

A: Installed in slot 0

© 2002, Cisco Systems, Inc.

B: Installed in slot 1

www.cisco.com

C: Installed in slot 2

CSPFA 2.1—4-17

The assignment of interface sequencing numbers is determined by the position of the quad card. The figure shows a quad card installed in slot 0, slot 1, and slot 2. Notice the difference in the numbering sequence. Example A shows that the quad card is numbered from top to bottom. The topmost connector is the outside interface. Example B shows how the slots are numbered if a single-port interface card is in slot 0 and a quad card is in slot 1. Example C shows how the slots are numbered if a single-port interface card is in slot 0 and slot 1, and a quad card is installed in slot 2.

Copyright  2002, Cisco Systems, Inc.

Identify the Cisco PIX Firewall

4-13

Identify the PIX Firewall 525 Controls and Connectors This section explains the controls and connectors for the PIX Firewall 525.

The PIX Firewall 525

Power LED

Activity LED © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—4-19

There are two LEDs on the front panel of the PIX Firewall 525. The LEDs function as follows:

4-14

■

POWER—On when the unit has power.

■

ACT—On when the unit is the active failover unit. If failover is present, the light is on when the unit is the active unit, and off when the unit is in standby mode.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

The PIX Firewall 525

100Mbps LED

ACT(ivity) ACT(ivity) LED LED LINK LINK LED LED

10/100BaseTX Ethernet 1 (RJ-45)

USB port 10/100BaseTX Ethernet 0 (RJ-45)

© 2002, Cisco Systems, Inc.

Failover Connection

Console Port (RJ-45)

www.cisco.com

CSPFA 2.1—4-20

On the back of the PIX Firewall 525, there are three LEDs for each RJ-45 interface port and three types of fixed interface connectors. The LEDs display the following transmission states: ■

100 Mbps—100 Mbps, 100BaseTX communication. If the light is off during network activity, that port is using 10 Mbps data exchange.

■

ACT—Shows network activity.

■

LINK—Shows that data is passing through that interface.

The following are fixed connectors on the back of the PIX Firewall 525: ■

RJ-45—Network and console connectors.

■

DB-15—Failover cable connector.

■

USB—Not used at the present time.

The inside, outside, or perimeter network connections can be made to any available interface port on the PIX Firewall 525. If you are only using the Ethernet 0 and Ethernet 1 ports, connect the inside network cable to the interface connector marked Ethernet 0 or Ethernet 1. Connect the outside network cable to the remaining Ethernet port. If you install optional circuit boards, refer to the following lists of combinations that are available for the PIX Firewall 525. A maximum of six circuit boards can be used with a restricted license, and a maximum of eight circuit boards are possible with the unrestricted license. The following are the PIX Firewall 525 Restricted Interface Options: ■

3 Fast Ethernet

■

2 Fast Ethernet + 1 VPN Accelerator

■

3 Gigabit Ethernet

Copyright  2002, Cisco Systems, Inc.

Identify the Cisco PIX Firewall

4-15

■

2 Gigabit Ethernet + 1 VPN Accelerator

■

1 4-Port Fast Ethernet

■

1 4-Port Fast Ethernet + 1 VPN Accelerator

The following are the PIX Firewall 525 Unrestricted Interface Options: ■

3 Fast Ethernet

■

2 Fast Ethernet + 1 VPN Accelerator

■

3 Gigabit Ethernet

■

2 Gigabit Ethernet + 1 VPN Accelerator

■

2 Gigabit Ethernet + 1 VPN Accelerator

■

1 4-port Fast Ethernet

■

1 4-port Fast Ethernet + 2 FE

■

1 4-port Fast Ethernet + 2 Gigabit Ethernet

■

1 4-port Fast Ethernet + 1 VPN Accelerator

■

1 4-port Fast Ethernet + 1 VPN Accelerator + FE

■

1 4-port Fast Ethernet + 1 VPN Accelerator + Gigabit Ethernet

When connecting the network cables to the expansion interface ports, use the following guidelines: the first expansion port number, at the top left, is interface 2. Starting from that port and going from left to right and top to bottom, the next port is interface 3, the next is interface 4, and so on.

4-16

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Identify the PIX Firewall 535 Controls and Connectors This section explains the controls and connectors for the PIX Firewall 535.

The PIX Firewall 535 Front Panel LEDs Power

© 2002, Cisco Systems, Inc.

ACT

www.cisco.com

CSPFA 2.1—4-22

There are two LEDs on the front panel of the PIX Firewall 535. The LEDs function as follows: ■

Power—On when the PIX Firewall has power.

■

ACT—On when the PIX Firewall is the active failover firewall. If failover is present, the light is on when the PIX Firewall is the active firewall and off when the PIX Firewall is in standby mode.

Copyright  2002, Cisco Systems, Inc.

Identify the Cisco PIX Firewall

4-17

PIX Firewall 535—Board Install DB-15 failover

USB port Console RJ-45

Slot 8

Slot 6

Slot 7

Slot 4 Slot 5

Bus 2 (32-bit/33 MHz)

Slot 2

Slot 0

Bus 1

Bus 0

(64-bit/66 MHz) (64-bit/66 MHz)

• 1GE-66

• 1FE • 4FE • VAC © 2002, Cisco Systems, Inc.

Slot 1

Slot 3

www.cisco.com

CSPFA 2.1—4-23

There are three separate buses for the nine interface slots in the PIX Firewall 535. The figure is a reference for the interface slot configuration on the PIX Firewall 535. The slots and buses are configured as follows: ■

Slots 0 and 1—64-bit/66 MHz Bus 0

■

Slots 2 and 3—64-bit/66 MHz Bus 1

■

Slots 4 to 8—32-bit/33 MHz Bus 2

The following practices must be followed to achieve the best possible system performance on the PIX 535 Firewall: ■

PIX-1GE-66 interface cards should be installed first in the 64-bit/66 MHz buses before they are installed in the 32-bit/33 MHz bus. If more than four PIX-1GE-66 cards are needed, they may be installed in the 32-bit/33 MHz bus but with limited potential throughput.

■

PIX-1GE and PIX-1FE cards should be installed first in the 32-bit/33 MHz bus before they are installed in the 64-bit/66 MHz buses. If more than five PIX-1GE and/or PIX-1FE cards are needed, they may be installed in a 64bit/66 MHz bus but doing so will lower that bus speed and limit the potential throughput of any PIX-1GE-66 card installed in that bus.

The PIX-1GE Gigabit Ethernet adaptor is supported in the PIX 535; however, its use is strongly discouraged because maximum system performance with the PIX1GE card is much lower than that with the PIX-1GE-66 card. The software displays a warning at boot time if a PIX-1GE is detected. The following table summarizes the performance considerations of the different interface card combinations.

4-18

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Interface Card Combination

Installed in Interface Slot Numbers

Potential Throughput

Two to four PIX-1GE-66

0 through 3

Best

PIX-1GE-66 combined with PIX1GE or just PIX-1GE cards

0 through 3

Degraded

Any PIX-1GE-66 or PIX-1GE

4 through 8

Severely degraded

Note

The PIX-4FE and PIX-VPN-ACCEL cards can be installed only in the 32-bit/33 MHz bus and must never be installed in a 64-bit/66 MHz bus. Installation of these cards in a 64-bit/66 MHz bus may cause the system to hang at boot time.

If Stateful Failover is enabled, the interface card and bus used for the Stateful Failover LAN port must be equal to or faster than the fastest card used for the network interface ports. For example, if your inside and outside interfaces are PIX-1GE-66 cards installed in bus 0, then your Stateful Failover interface must be a PIX-1GE-66 card installed in bus 1. A PIX-1GE or PIX-1FE card cannot be used in this case, nor can a PIX-1GE-66 card installed in bus 2 or sharing bus 1 with a slower card.

Copyright  2002, Cisco Systems, Inc.

Identify the Cisco PIX Firewall

4-19

The PIX Firewall 535 DB-15 failover

USB Slot 8 Slot 6 Slot 4 Slot 2 port Console Slot 7 Slot 5 Slot 3 RJ-45

© 2002, Cisco Systems, Inc.

Slot 1 Slot 0

www.cisco.com

CSPFA 2.1—4-24

Depending upon the type of interface, there are four possible LEDs for each network interface port. The LEDs for the network interface ports display the following transmission states:

■

100 Mbps—100 Mbps 100BaseTX communication. If the light is off during network activity, that port is using 10 Mbps data exchange. ACT—Shows network activity.

■

LINK—Shows that data is passing through that interface.

■

FDX—Shows that the connection uses full-duplex data exchange where data can be transmitted and received simultaneously. If this light is off, halfduplex is in effect. When connecting the inside, outside, or perimeter network cables to the interface ports on the PIX 535 Firewall, starting from the right and moving left, the connectors are Ethernet 0, Ethernet 1, Ethernet 2, and so forth. ■

Note

4-20

The PIX Firewall 535 is equipped with hot-swappable power supplies. Should a power supply fail, you can remove the power supply without powering off the PIX Firewall 535 unit.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Summary This section summarizes what you learned in this chapter.

Summary • The PIX Firewall models 501, 506, 515, 520, 525, and 535 come equipped with Ethernet connections, console connections, and intuitive LEDs. • With software versions 5.2 and higher, restrictions on using specific Ethernet ports as the inside and outside network ports have been removed; however, this revision does not change the rules for port numbering. • PIX Firewall models 515, 520, 525, and 535 come equipped with failover connections.

© 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—4-26

Identify the Cisco PIX Firewall

4-21

4-22

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

5

Basic Configuration of the Cisco PIX Firewall

Overview This chapter includes the following topics: ■

Objectives

■

General maintenance commands

■

ASA security levels

■

The six primary commands

■

Summary

■

Lab exercise

Objectives This section lists the chapter’s objectives.

Objectives Upon completion of this chapter, you will be able to perform the following tasks: • Describe the PIX Firewall access modes. • Describe and execute the PIX Firewall general maintenance commands. • Describe the ASA security levels. • Describe and execute the basic PIX Firewall configuration commands.

© 2002, Cisco Systems, Inc.

5-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—5-2

Copyright  2002, Cisco Systems, Inc.

General Maintenance Commands This section references access modes and commands associated with the operation of the Cisco PIX Firewall.

Access Modes The PIX Firewall has four administrative access modes: • Unprivileged mode • Privileged mode • Configuration mode • Monitor mode

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-4

The PIX Firewall contains a command set based on the Cisco IOS, and provides four administrative access modes: ■

Unprivileged mode—This mode is available when you first access the PIX Firewall. The > prompt is displayed. This mode enables you to view restricted settings.

■

Privileged mode—This mode displays the # prompt and enables you to change the current settings. Any unprivileged command also works in privileged mode.

■

Configuration mode—This mode displays the (config)# prompt and enables you to change system configurations. All privileged, unprivileged, and configuration commands work in this mode.

■

Monitor mode—This is a special mode that enables you to update the image over the network. While in the monitor mode, you can enter commands specifying the location of the TFTP server and the binary image to download.

Within each access mode, you can abbreviate most commands down to the fewest unique characters for a command. For example, you can enter write t to view the configuration instead of entering the full command write terminal. You can enter en instead of enable to start privileged mode, and co t instead of configuration terminal to start configuration mode. Help information is available from the PIX Firewall command line by entering help or ? to list all commands. If you enter help or ? after a command (for Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-3

example, route?), the command syntax is listed. The number of commands listed when you use the question mark or help command differs by access mode so that unprivileged mode offers the least commands and configuration mode offers the greatest number of commands. In addition, you can enter any command by itself on the command line and then press Enter to view the command syntax. Note

5-4

You can create your configuration on a text editor and then cut and paste it into the configuration. You can paste the configuration in a line at a time, or the entire configuration at once. Always check your configuration after pasting large blocks of text to be sure everything has been copied.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

PIX Firewall Commands

• enable, enable password, and passwd • write erase, write memory, and write term • show interface, show ip address, show memory, show version, and show xlate • exit and reload • hostname, ping, and telnet

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-5

There are several general maintenance commands for the PIX Firewall: ■

enable, enable password, and passwd commands—Used for accessing the PIX Firewall software and changing passwords.

■

write erase, write memory, and write term—Used to view system configurations and store new data configurations.

■

show interface, show ip address, show memory, show version, and show xlate—Used to check system configurations and other pertinent information.

■

exit and reload—Used to exit an access mode, reload a configuration, and reboot the system.

■

hostname, ping, and telnet—Used to determine if other IP addresses are visible, change the hostname, specify the internal host for the PIX Firewall, and gain console access.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-5

enable Command pixfirewall>

enable • Enables you to enter different access modes pixfirewall> enable password: pixfirewall# configure terminal pixfirewall(config)# pixfirewall(config)# exit pixfirewall# © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-6

The enable command enables you to enter the privileged access modes. After you enter enable, the PIX Firewall prompts you for your privileged mode password. By default, a password is not required, so press Enter. After you are in privileged mode, notice that the prompt has changed to #. When you type configure terminal, it brings you into the configuration mode and the prompt changes to (config)#. To exit and return to the previous mode, use the disable, exit, or quit command.

5-6

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

enable password and passwd Commands pixfirewall#

enable password password • The enable password command is used to control access to the privileged mode. pixfirewall#

passwd password • The passwd command is used to set a Telnet password. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-7

The enable password command sets the privileged mode password. You are prompted for this password after you enter the enable command. (When the PIX Firewall boots up and you enter the privileged mode, the password prompt appears.) There is no default password, so you can press Enter at the password prompt, or you can create a password of your choice. The password is case-sensitive and can be up to 16 alphanumeric characters long. Any character can be used except the question mark, space, and colon. If you change the password, write it down and store it in a manner consistent with your site’s security policy. After you change this password, you cannot view it again because the password is encrypted. The show enable password command lists the encrypted form of the password. After passwords are encrypted, they cannot be reversed back to plain text. The passwd command enables you to set the password for Telnet access to the PIX Firewall. The default value is cisco. Note

Copyright  2002, Cisco Systems, Inc.

Any empty password is also changed into an encrypted string.

Basic Configuration of the Cisco PIX Firewall

5-7

write Commands The following are the write commands: • write net • write erase • write floppy • write memory • write standby • write terminal

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-8

The write command enables you to write (store) system configurations to memory, view system configurations, and erase current configurations. The following are the write commands: ■

write net—Stores the current configuration into a file on a TFTP server or elsewhere in the network.

■

write erase—Clears the Flash memory configuration.

■

write floppy—Stores the current configuration on diskette (the PIX Firewall 520 and earlier models have a 3.5-inch floppy disk drive).

Note

5-8

If you are formatting a floppy diskette from a Windows operating system, choose the full-format type and not the quick-erase selection. The diskette you create can only be read or written by the PIX Firewall. If you use the write floppy command with a diskette that is not a PIX Firewall boot disk, do not leave it in the floppy drive because it will prevent the firewall from rebooting in the event of a power failure or system reload. Only one copy of the configuration can be stored on a single diskette.

■

write memory—Saves the current running configuration to Flash memory.

■

write standby—Writes the configuration stored in RAM on the active failover PIX Firewall, to the RAM on the standby PIX Firewall. When the active PIX Firewall boots, it automatically writes the configuration to the standby PIX Firewall. Use this command to force the active PIX Firewall’s configuration to the standby PIX Firewall.

■

write terminal—Displays the current configuration on the terminal.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

telnet Commands pixfirewall(config)#

telnet ip_address [netmask] [if_name] • Enables you to specify which hosts can access the PIX Firewall console via Telnet pixfirewall(config)#

kill telnet_id • Terminates a Telnet session pixfirewall(config)#

who [local_ip] • Enables you to view which IP addresses are currently accessing the PIX Firewall console via Telnet © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-9

The following are the different Telnet commands: ■

telnet—Enables you to specify which hosts can access the PIX Firewall console via Telnet. You can specify a host on any of the internal network interfaces that can access the console via Telnet, but you cannot specify hosts on the outside network interfaces. Up to 16 hosts or networks are allowed simultaneous access to the PIX Firewall console via Telnet. –

show telnet—Displays the current lists of IP addresses authorized to access the PIX Firewall via Telnet.

–

clear telnet and no telnet—Removes Telnet access from a previously authorized IP address.

–

telnet timeout—Sets the maximum time a console Telnet session can be idle before being logged off by the PIX Firewall.

■

kill—Terminates a Telnet session. When you kill a Telnet session, the PIX Firewall lets any active commands terminate and then drops the connection without warning the user.

■

who—Enables you to view which IP addresses are currently accessing the PIX Firewall console via Telnet.

The syntax of these commands follows: telnet ip_address [netmask] [if_name] clear telnet [ip_address [netmask] [if_name]] no telnet [ip_address [netmask] [if_name]] telnet timeout minutes kill telnet_id who local_ip

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-9

5-10

ip_address

An IP address of a host or network that can access the PIX Firewall Telnet console. If an interface name is not specified, the address is assumed to be on an internal interface. The PIX Firewall automatically verifies the IP address against the IP addresses specified by the ip address commands to ensure that the address you specify is on an internal interface. If an interface name is specified, the PIX Firewall only checks the host against the interface you specify.

netmask

The bit mask of ip_address. To limit access to a single IP address, use 255 in each octet (for example, 255.255.255.255). If you do not specify the netmask, it defaults to 255.255.255.255 regardless of the class of local_ip. Do not use the subnetwork mask of the internal network. The netmask is only a bit mask for the IP address in ip_address.

if_name

If IPSec is operating, the PIX Firewall enables you to specify an unsecure interface name, typically, the outside interface. At a minimum, the crypto map command must be configured to specify an interface name with the telnet command.

minutes

The number of minutes that a Telnet session can be idle before being closed by the PIX Firewall. The default is 5 minutes. The range is 1 to 60 minutes.

telnet_id

The Telnet session identification.

local_ip

An optional internal IP address to limit the listing to one IP address or to a network IP address.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

http Commands pixfirewall(config)#

http ip_address [netmask] [if_name] • Enables you to specify the clients that are allowed to access the PIX Firewall’s HTTP server pixfirewall(config)#

http server enable • Enables the PIX Firewall HTTP server

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-10

The http commands allow you to enable the PIX Firewall HTTP server and specify the clients that are allowed to access it. The HTTP server must be enabled to configure and monitor the PIX Firewall through the PIX Device Manager (PDM). PDM is discussed in Chapter 16. Use the http server enable command to enable the PIX Firewall’s HTTP server. Specify the clients that are allowed to access it with the http ip_address command. Both commands can be disabled with their no forms. The clear http command removes all HTTP hosts and disables the server. The syntax of the http commands follows: http ip_address [netmask] [if_name] http server enable ip_address

Specifies the host or network authorized to initiate an HTTP connection to the PIX Firewall.

netmask

Specifies the network mask for the http ip_address. If you do not specify a netmask, the default is 255.255.255.255 regardless of the class of IP address.

if_name

The PIX Firewall interface name on which the host or network initiating the HTTP connection resides. The default if_name is inside.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-11

hostname and ping Commands pixfirewall(config)#

hostname newname • hostname command

pixfirewall (config)# hostname proteus proteus(config)# hostname pixfirewall pixfirewall(config)#

ping [if_name] ip_address • ping command

pixfirewall(config)# ping 10.0.0.3 10.0.0.3 response received -- 0Ms 10.0.0.3 response received -- 0Ms 10.0.0.3 response received -- 0Ms © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-11

The hostname command changes the hostname label on the prompts. The hostname can be up to 16 alphanumeric characters and upper- and lower-case. The default hostname is pixfirewall. The ping command determines if the PIX Firewall has connectivity, or if a host is available (visible to the PIX Firewall) on the network. The command output shows if the ping was received. If the ping was received, then the host exists on the network. If the ping was not received, the command output displays “NO response received”. (At this time, you would use the show interface command to ensure that the PIX Firewall is connected to the network and is passing traffic.) By default, the ping command makes three attempts to reach an IP address. If you want internal hosts to be able to ping external hosts, you must create an ICMP conduit for echo reply. This will be discussed later in another chapter. If you are pinging through the PIX Firewall between hosts or routers and the pings are not successful, use the debug icmp trace command to monitor the success of the ping. After your PIX Firewall is configured and operational, you will not be able to ping the inside interface of the PIX Firewall from the outside network or from the outside interfaces of the PIX Firewall. If you can ping the inside networks from the inside interface and if you can ping the outside networks from the outside interface, the PIX Firewall is functioning normally and your routes are correct.

5-12

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

show Commands The following are show commands: • show history • show memory show?

• show version • show xlate • show cpu usage

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-12

The show command enables you to view command information. This command is usually combined with another command to show system information for that command. You can enter either show or ? to view the names of the show commands and their descriptions. The following are examples of different show commands: ■

show history—Displays previously entered lines.

■

show memory—Displays a summary of the maximum physical memory and current free memory available to the PIX Firewall.

■

show version—Enables you to view the PIX Firewall’s software version, operating time since its last reboot, processor type, Flash memory type, interface boards, and serial number (BIOS ID).

Note

The serial number listed with the show version command in version 5.2 and later is for the Flash memory BIOS. This number is different from the serial number on the chassis. When you upgrade your software, you will need the serial number that appears in the show version command rather than the one on the chassis.

■

show xlate—Displays the translation slot information.

■

show cpu usage—Displays CPU use. This command is permitted from the privileged or configuration mode.

In the following example output for the show cpu usage command, p1 is the percentage of CPU used for 5 seconds, p2 is the average percentage of CPU use for 1 minute, and p3 is the average percentage utilization for 5 minutes: CPU utilization for 5 seconds: p1%; 1 minute: p2%; 5 minutes: p3%

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-13

The percentage of usage is shown as NA (not available) if the usage is not available for any of the time intervals. This can happen if the user asks for CPU usage before the 5-second, 1-minute, or 5-minute time interval has elapsed.

5-14

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

show interface Command pixfirewall# show interface interface ethernet0 “outside” is up, line protocol is up hardware is i82557 ethernet, address is 0060.7380.2f16 ip address 192.168.0.2, subnet mask 255.255.255.0 MTU 1500 bytes, BW 1000000 Kbit half duplex 1184342 packets input, 1222298001 bytes, 0 no buffer received 26 broadcasts, 27 runts, 0 giants 4 input errors, 0 crc, 4 frame, 0 overrun, 0 ignored, 0 abort 1310091 packets output, 547097270 bytes, 0 underruns 0 unicast rpf drops 0 output errors, 28075 collisions, 0 interface resets 0 babbles, 0 late collisions, 117573 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0/1) output queue (curr/max blocks): hardware (0/2) software (0/1)

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-13

The show interface command enables you to view network interface information. This is one of the first commands you should use when trying to establish connectivity. The following are explanations of the information that is displayed after entering the show interface command: ■

Ethernet—Indicates that you have used the interface command to configure the interface. The statement indicates whether the interface is inside or outside, and whether the interface is available (“up”) or not available (“down”).

■

Line protocol up—A working cable is plugged into the network interface.

■

Line protocol down—Either the cable plugged into the network interface is incorrect, or it is not plugged into the interface connector.

■

Network interface type—Identifies the network interface.

■

Interrupt vector—It is acceptable for interface cards to have the same interrupts because the PIX Firewall uses interrupts to get Token Ring information, but polls Ethernet cards.

■

MAC address—Intel cards begin with “i” and 3Com cards begin with “3c”.

■

MTU (maximum transmission unit)—The size in bytes that data can best be sent over the network.

■

Packets input—Indicates that packets are being received in the PIX Firewall.

■

Packets output—Indicates that packets are being sent from the PIX Firewall.

■

Line duplex status—Indicates whether the PIX Firewall is running either full duplex (simultaneous packet transmission) or half duplex (alternating packet transmission).

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-15

■

Line speed—10baseT is listed as 10000 Kbit. 100baseTX is listed as 100000 Kbit.

The following are explanations of show interface command output that can indicate interface problems: ■

No buffer—Indicates the PIX Firewall is out of memory or slowed down due to heavy traffic and cannot keep up with the received data.

■

Runts—Packets with less information than expected.

■

Giants—Packets with more information than expected.

■

CRC (cyclic redundancy check)—Packets that contain corrupted data (checksum error).

■

Frame errors—Indicates framing errors.

■

Ignored and aborted errors—This information is provided for future use, but is not currently checked; the PIX Firewall does not ignore or abort frames.

■

Underruns—Occurs when the PIX Firewall is overwhelmed and cannot get data fast enough to the network interface card.

■

Overruns—Occurs when the network interface card is overwhelmed and cannot buffer received information before more needs to be sent.

■

Unicast rpf drops—Occurs when packets sent to a single network destination using reverse path forwarding are dropped.

■

Output errors—(Maximum collisions.) The number of frames not transmitted because the configured maximum number of collisions was exceeded. This counter should only increment during heavy network traffic.

■

Collisions—(Single and multiple collisions.) The number of messages retransmitted due to an Ethernet collision. This usually occurs on an overextended LAN when the Ethernet or transceiver cable is too long, there are more than two repeaters between stations, or there are too many cascaded multiport transceivers. A packet that collides is counted only once by the output packets.

■

Interface resets—The number of times an interface has been reset. If an interface is unable to transmit for three seconds, the PIX Firewall resets the interface to restart transmission. During this interval, the connection state is maintained. An interface reset can also happen when an interface is looped back or shut down.

■

Babbles—The transmitter has been on the interface longer than the time taken to transmit the largest frame. This counter is unused.

■

Late collisions—The number of frames that were not transmitted because a collision occurred outside the normal collision window. A late collision is a collision that is detected late in the transmission of the packet. Normally, these should never happen. When two Ethernet hosts try to talk at once, they should collide early in the packet and both back off, or the second host should see that the first one is talking and wait. If you get a late collision, a device is jumping in and trying to send on the Ethernet while the PIX Firewall is partly finished sending the packet. The PIX Firewall does not resend the packet, because it may have freed the buffers that held the first part of the packet. This is not a real problem

5-16

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

because networking protocols are designed to cope with collisions by resending packets. However, late collisions indicate a problem exists in your network. Common problems are large repeated networks and Ethernet networks running beyond the specification. ■

Deferred—The number of frames that were deferred before transmission due to activity on the link.

■

Lost carrier—The number of times the carrier signal was lost during transmission.

■

No carrier—This counter is unused.

■

Input queue—This is the input (receive) hardware and software queue.

■

–

Hardware—(Current and maximum blocks.) The number of blocks currently present on the input hardware queue, and the maximum number of blocks previously present on that queue.

–

Software—(Current and maximum blocks.) The number of blocks currently present on the input software queue, and the maximum number of blocks previously present on that queue.

Output queue—This is the output (transmit) hardware and software queue. –

Hardware—(Current and maximum blocks.) The number of blocks currently present on the output hardware queue, and the maximum number of blocks previously present on that queue.

–

Software—(Current and maximum blocks.) The number of blocks currently present on the output software queue, and the maximum number of blocks previously present on that queue.

Note

The following counters are only valid for Ethernet interfaces: output errors, collisions, interface resets, babbles, late collisions, deferred, lost carrier, and no carrier.

Note

Starting with PIX Firewall software version 6.0(1), FDDI, PL2, and Token Ring interfaces are not supported.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-17

show ip address Command

pixfirewall# show ip address Building configuration…… System IP Addresses: ip address outside 192.168.0.2 255.255.255.0 ip address inside 10.0.0.1 255.255.255.0 ip address dmz 172.16.0.1 255.255.255.0 Current IP Addresses: ip address outside 192.168.0.2 255.255.255.0 ip address inside 10.0.0.1 255.255.255.0 ip address dmz 172.16.0.1 255.255.255.0

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-14

The show ip address command enables you to view which IP addresses are assigned to the network interfaces. The current IP addresses are the same as the system IP addresses on the failover active unit. When the active unit fails, the current IP address becomes that of the standby unit.

5-18

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

name Command pixfirewall(config)# DMZ DMZ

name ip_address name • Configures a list of name-to-IP address mappings on the PIX Firewall

pixfirewall(config)# name 172.16.0.2 bastionhost

192.168.0.0/24 e0 .2 e1 .1

e2 .1

.2

Bastion host

172.16.0.0/24

10.0.0.0/24

• The use of this command configures a list of name-to-IP address mappings on the PIX Firewall

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-15

The use of the name command enables you to configure a list of name-to-IP address mappings on the PIX Firewall. This allows the use of names in the configuration instead of the IP address. You can specify a name by using the following syntax: name ip_address name ip_address

The IP address of the host being named.

name

The name assigned to the IP address. Allowable characters are a to z, A to Z, 0 to 9, a dash, and an underscore. The name cannot start with a number. If the name is over 16 characters long, the name command fails.

Allowable characters for the name are a to z, A to Z, 0 to 9, a dash ( - ), and an underscore ( _ ). The name cannot start with a number. If the name is over 16 characters long, the name command fails.After the name is defined, it can be used in any PIX Firewall command references in place of an IP address.The names command enables the use of the name command. You must first use the names command before using the name command. The clear names and no names commands are the same, and disable use of the name text strings. The show names command lists the name command statements in the configuration.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-19

ASA Security Levels This section discusses the Adaptive Security Algorithm (ASA) and the ASA security levels.

Functions of the Adaptive Security Algorithm • Implements stateful connection control through the PIX Firewall • Allows one-way (inside to outside) connections without an explicit configuration for each internal system and application • Monitors return packets to ensure they are valid • Randomizes the TCP sequence number to minimize the risk of attack

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-17

The ASA is a stateful approach to security. Every inbound packet is checked against the ASA and against connection state information in the PIX Firewall’s memory. Knowledge of the ASA is fundamental to implementing Internet access security because it performs the following tasks: ■

Implements stateful connection control through the PIX Firewall

■

Allows one-way (inside to outside) connections without an explicit configuration for each internal system application

■

Monitors return packets to ensure they are valid

■

Randomizes the TCP sequence number to minimize the risk of attack

ASA maintains the secure perimeters between the networks controlled by the PIX Firewall. The stateful connection-oriented ASA design creates session flows based on source and destination addresses. ASA randomizes TCP sequence numbers, port numbers, and TCP flags before the completion of the connection. This function is always running, monitoring return packets to ensure that they are valid.

5-20

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

ASA Security Level Example Outside network e0 e0 •• Security Security level level 00 •• Interface Interface name name == outside outside

Internet

e0 PIX Firewall e1

e2

Inside network

Perimeter network

e1 e1 •• Security Security level level 100 100 •• Interface Interface name name == inside inside

e2 e2 •• Security Security level level 50 50 •• Interface Interface name name == pix/intf2 pix/intf2

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-18

The security level designates whether an interface is inside (trusted) or outside (untrusted) relative to another interface. An interface is considered inside in relation to another interface if its security level is higher than the other interface’s security level, and is considered outside in relation to another interface if its security level is lower than the other interface’s security level. The primary rule for security levels is that an interface with a higher security level can access an interface with a lower security level. Conversely, an interface with a lower security level cannot access an interface with a higher security level without a conduit (which is discussed later). Security levels range from 0 to 100, and the following are more specific rules for these security levels: ■

Security level 100—This is the highest security level for the inside interface of the PIX Firewall. This is the default setting for the PIX Firewall and cannot be changed. Because 100 is the most trusted interface security level, your corporate network should be set up behind it. This is so that no one else can access it unless they are specifically given permission, and so that every device behind this interface can have access outside the corporate network.

■

Security level 0—This is the lowest security level for the outside interface of the PIX Firewall. This is the default setting for the PIX Firewall and cannot be changed. Because 0 is the least trusted interface security level, you should set your most untrusted network behind this interface so that it does not have access to other interfaces unless it is specifically given permission. This interface is usually used for your Internet connection.

■

Security levels 1−99—These are the security levels that you can assign to the perimeter interfaces connected to the PIX Firewall. You assign the security levels based on the type of access you want each device to have.

The following are examples of different interface connections between the PIX Firewall and other perimeter devices:

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-21

■

More secure interface (the higher security level) to a less secure interface (the lower security level)—Traffic originating from the inside interface of the PIX Firewall with a security level of 100 to the outside interface of the PIX Firewall with a security level of 0 follows this rule: allow all IP-based traffic unless restricted by access lists, authentication, or authorization.

■

Less secure interface (lower security level) to a more secure interface (higher security level)—Traffic originating from the outside interface of the PIX Firewall with a security level of 0 to the inside interface of the PIX Firewall with a security level of 100 follows this rule: drop all packets unless specifically allowed by the conduit command. Further restrict the traffic if authentication and authorization is used.

■

Same secure interface to a same secure interface—No traffic flows between two interfaces with the same security level.

The following table explains the diagram in the previous figure. Interface Pair

Configuration Guidelines

Outside security 0 to DMZ security 50

DMZ is considered inside

Statics and conduits must be configured to enable sessions originated from the outside interface to the DMZ interface.

Inside security 100 to DMZ security 50

DMZ is considered outside

Globals and NAT are configured to enable sessions originated from the inside interface to the DMZ interface. Statics may be configured for the DMZ interface to ensure service hosts have the same source address.

Note

5-22

Relative Interface Relationship for Ethernet 2 (DMZ) Interface

The PIX Firewall can have up to six perimeter networks for a total of eight interfaces.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

The Six Primary Commands This section contains the six primary commands needed to make the PIX Firewall operational.

PIX Firewall Primary Commands There are six primary configuration commands for the PIX Firewall: • • • • • •

nameif interface ip address nat global route

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-20

There are six primary configuration commands for the PIX Firewall: ■

nameif—Assigns a name to each perimeter interface and specifies its security level.

■

interface—Configures the type and capability of each perimeter interface.

■

ip address—Assigns an IP address to each interface.

■

nat—Shields IP addresses on the inside network from the outside network.

■

global—Shields IP addresses on the inside network from the outside network using a pool of IP addresses.

■

route—Defines a static or default route for an interface.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-23

Command 1: nameif pixfirewall(config)#

nameif hardware_id if_name security_level • The nameif command assigns a name to each perimeter interface on the PIX Firewall and specifies its security level.

pixfirewall(config)# nameif ethernet2 dmz sec50

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-21

The command nameif assigns a name to each perimeter interface on the PIX Firewall and specifies its security level (except for the inside and outside PIX Firewall interfaces, which are named by default). The syntax for the nameif command is as follows: nameif hardware_id if_name security_level hardware_id

Specifies a perimeter interface and its slot location on the PIX Firewall. There are three interfaces that you can enter here: Ethernet, FDDI, or Token Ring. Each interface is represented by an alphanumeric identifier based on which interface it is and what numeric identifier you choose to give it. For example, an Ethernet interface is represented as e1, e2, e3, and so on; a FDDI interface is represented as fddi1, fddi2, fddi3, and so on; and a Token Ring interface is represented as token-ring1, token-ring2, and token-ring3, and so on.

5-24

if_name

Describes the perimeter interface. This name is assigned by you, and must be used in all future configuration references to the perimeter interface.

security_level

Indicates the security level for the perimeter interface. Enter a security level of 1−99.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Command 2: interface pixfirewall(config)#

interface hardware_id hardware_speed • The interface command configures the type and capability of each perimeter interface.

pixfirewall(config)# interface ethernet0 100full pixfirewall(config)# interface ethernet1 100full • The outside and inside interfaces are set for 100 Mbps Ethernet full-duplex communication.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-22

The interface command identifies hardware, sets its hardware speed, and enables the interface. When an additional Ethernet interface card is installed on the PIX Firewall, the PIX Firewall automatically recognizes the additional card. The syntax for the interface command is as follows: interface hardware_id hardware_speed [shutdown] hardware_id

Specifies an interface and its slot location on the PIX Firewall. This is the same variable that was used during the nameif command.

hardware_speed

Determines the connection speed. Possible Ethernet values are as follow:

Copyright  2002, Cisco Systems, Inc.

■

10baset—Set for 10 Mbps Ethernet halfduplex communication.

■

10full—Set for 10 Mbps Ethernet fullduplex communication.

■

100basetx—Set for 100 Mbps Ethernet half-duplex communication.

■

100full—Set for 100 Mbps Ethernet fullduplex communication.

■

1000sxfull—Set for 1000 Mbps Gigabit Ethernet full-duplex operation.

■

1000basesx—Set for 1000 Mbps Gigabit Ethernet half-duplex operation.

■

1000auto—Set for 1000 Mbps Gigabit Ethernet to auto-negotiate full- or halfduplex. It is recommended that you do not use this option to maintain compatibility with switches and other devices in your network.

Basic Configuration of the Cisco PIX Firewall

5-25

■

aui—Set 10 for Mbps Ethernet half-duplex communication with an AUI cable interface.

■

auto—Set Ethernet speed automatically. The auto keyword can only be used with the Intel 10/100 automatic speed sensing network interface card.

■

bnc—Set for 10 Mbps Ethernet half-duplex communication with a BNC cable interface.

Possible Token Ring values are as follow:

shutdown

■

4mbps—4 Mbps data transfer speed. You can specify this as 4.

■

16mbps—(Default.) 16 Mbps data transfer speed. You can specify this as 16.

Administratively shuts down the interface.

Although the hardware speed is set to automatic speed sensing by default, it is recommended that you specify the speed of the network interfaces. This enables the PIX Firewall to operate in network environments that may include switches or other devices that do not handle auto sensing correctly. Note

5-26

When a FDDI or Token Ring interface card is installed using the interface command, you must define the FDDI or Token Ring interface card because the PIX Firewall does not automatically recognize it. Starting with PIX Firewall software version 6.0(1), FDDI, PL2, and Token Ring interfaces are not supported.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Command 3: ip address

pixfirewall(config)#

ip address if_name ip_address [netmask] • The ip address command assigns an IP address to each interface.

pixfirewall(config)# ip address dmz 172.16.0.1 255.255.255.0

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-23

Each interface on the PIX Firewall must be configured with an IP address. The syntax for the ip address command is as follows: ip address if_name ip_address [netmask] if_name

Describes the interface. This name is assigned by you, and must be used in all future configuration references to the interface.

ip_address

The IP address of the interface.

netmask

If a network mask is not specified, the default network mask is assumed.

After configuring the IP address and netmask, use the show ip command to view which addresses are assigned to the network interfaces. If you made a mistake while entering the information, reenter the command with the correct information.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-27

Command 4: nat pixfirewall(config)#

nat [(if_name)] nat_id local_ip [netmask] • The nat command shields IP addresses on the inside network from the outside network.

pixfirewall(config)# nat (inside) 1 0.0.0.0 0.0.0.0

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-24

Network address translation (NAT) enables you to keep your internal IP addresses—those behind the PIX Firewall—unknown to external networks. NAT accomplishes this by translating the internal IP addresses, which are not globally unique, into globally accepted IP addresses before packets are forwarded to the external network. The syntax for the nat command is as follows: nat [(if_name)] nat_id local_ip [netmask] if_name

Describes the internal network interface name where you will use the global addresses.

nat_id

Identifies the global pool and matches it with its respective nat command.

local_ip

The IP address that is assigned to the interface on the inside network.

netmask

Network mask for the local IP address. You can use 0.0.0.0 to allow all outbound connections to translate with IP addresses from the global pool.

When you initially configure the PIX Firewall, you can enable all inside hosts to access outbound connections with the nat 1 0.0.0.0 0.0.0.0 command. The nat 1 0.0.0.0 0.0.0.0 command enables NAT and lets all inside hosts (specified as 0.0.0.0) access outbound connections. The nat command can specify single hosts or ranges of hosts to make access more selective. 0 can be used in place of 0.0.0.0.

5-28

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

NAT Example Inside Source addr

Outside Source addr

10.0.0.3

Destination addr 200.200.200.10 200.200.200.10

Destination addr 200.200.200.10 Source port Destination port

10.0.0.3

192.168.0.20 192.168.0.20

49090

Source port

23

Destination port

192.168.0.20

49090 23 23

Internet

10.0.0.3

10.0.0.4 Translation table

© 2002, Cisco Systems, Inc.

Inside Local IP Address

Global IP Pool

10.0.0.3 10.0.0.4

192.168.0.20 192.168.0.21

www.cisco.com

CSPFA 2.1—5-25

When an outbound IP packet that is sent from a device on the inside network reaches the PIX Firewall, the source address is extracted and compared to an internal table of existing translations. If the device’s address is not already in the table, it is then translated: a new entry is created for that device and it is assigned a global IP address from a pool of global IP addresses. After this translation occurs, the table is updated and the translated IP packet is forwarded. After a userconfigurable timeout period (or the default of two minutes), during which there have been no translated packets for that particular IP address, the entry is removed from the table, and the global address is freed for use by another inside device.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-29

Command 5: global pixfirewall(config)#

global[(if_name)] nat_id {global_ip[-global_ip] [netmask global_mask]} | interface • Works with the nat command to assign a registered or public IP address to an internal host when accessing the outside network through the firewall

pixfirewall(config)# nat (inside) 1 0.0.0.0 0.0.0.0 pixfirewall(config)# global (outside) 1 192.168.0.20-192.168.0.254 • When internal hosts access the outside network through the firewall, they are assigned public addresses from the 192.168.0.20–192.168.0.254 range

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-26

The syntax for the global command is as follows: global [(if_name)] nat_id global_ip [-global_ip] [netmask global_mask] | interface if_name

Describes the external network interface name where you will use the global addresses.

nat_id

Identifies the global pool and matches it with its respective nat command.

global_ip

Single IP addresses or the beginning IP address for a range of global IP addresses.

-global_ip

A range of global IP addresses.

netmask global_mask

The network mask for the global_ip address. If subnetting is in effect, use the subnet mask (for example, 255.255.255.128). If you specify an address range that overlaps subnets with the netmask command, this command will not use the broadcast or network address in the pool of global addresses. For example, if you use 255.255.255.128 and an address range of 192.150.50.20−192.150.50.140, the 192.150.50.127 broadcast address and the 192.150.50.128 network address will not be included in the pool of global addresses.

interface

Specifies PAT using the IP address at the interface.

If the nat command is used, the companion command, global, must be configured to define the pool of translated IP addresses. To delete a global entry, use the no global command. For example, no global (outside) 1 192.168.1.20− −192.168.1.254 netmask 255.255.255.0.

5-30

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Note

The PIX Firewall assigns addresses from the global pool starting from the low end to the high end of the range specified in the global command.

Note

The PIX Firewall uses the global addresses to assign a virtual IP address to an internal NAT address. After adding, changing, or removing a global statement, use the clear xlate command to make the IP addresses available in the translation table.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-31

Two Interfaces with NAT (Multiple Internal Networks) Internet

Pod perimeter router

.1 192.168.0.0/24

e0 outside .2 security level 0

PIX Firewall 10.0.0.0 /24

e1 inside .1 security level 100

172.26.26.50 10.1.0.0 /24

Backbone, web, FTP, and TFTP server

pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# pixfirewall(config)#

nat(inside) 1 10.0.0.0 255.255.255.0 nat (inside) 2 10.1.0.0 255.255.255.0 global(outside) 1 192.168.0.1-192.168.0.14 netmask 255.255.255.240 global(outside) 2 192.168.0.17-192.168.0.30 netmask 255.255.255.240

• All hosts on the inside networks can start outbound connections. • A separate global pool is used for each internal network. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-27

In the previous figure, the first nat statement permits all hosts on the 10.0.0.0 network to start outbound connections using the IP addresses from a global pool. The second nat statement permits all hosts on the 10.1.0.0 network to do the same. The nat_id in the first nat statement tells the PIX Firewall to translate the 10.0.0.0 addresses to those in the global pool containing the same nat_id. Likewise, the nat_id in the second nat statement tells the PIX Firewall to translate addresses for hosts on network 10.1.0.0 to the addresses in the global pool containing nat_id.

5-32

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Three Interfaces with NAT Internet

Pod perimeter router

.1 192.168.0.0/24

e0 outside .2 security level 0

PIX Firewall e1 inside .1 security level 100

e2 dmz .1 security level 50

172.16.0.0/24 Bastion host, and web and FTP server

.2

172.26.26.50 Backbone, web, FTP, and TFTP server

10.0.0.0 /24 .3 Inside host, and web and FTP server

pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# pixfirewall(config)#

nat(inside) 1 10.0.0.0 255.255.255.0 nat (dmz) 1 172.16.0.0 255.255.255.0 global (outside) 1 192.168.0.20-192.168.0.254 netmask 255.255.255.0 global(dmz) 1 172.16.0.20-172.16.0.254 netmask 255.255.255.0

• Inside users can start outbound connections to both the DMZ and the Internet. • The nat (dmz) command gives DMZ services access to the Internet. • The global (dmz) command gives inside users access to the web server on the DMZ. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-28

In the previous figure, the first nat statement enables hosts on the inside interface, which has a security level of 100, to start connections to hosts on interfaces with lower security levels. In this case, that includes hosts on the outside interface and hosts on the DMZ. The second nat statement enables hosts on the DMZ, which has a security level of 50, to start connections to hosts on interfaces with lower security levels. In this case, that includes only the outside interface. Because both global pools and the nat (inside) statement, use a nat_id of 1. Addresses for hosts on the 10.0.0.0 network can be translated to those in either global pool. Therefore, when users on the inside interface access hosts on the DMZ, their source addresses will be translated to addresses in the 172.16.0.2−172.16.0.254 range from the global (dmz) statement. When they access hosts on the outside, their source addresses will be translated to addresses in the 192.168.0.20−192.168.0.254 range from the global (outside) statement. When users on the DMZ access hosts on the outside, their source addresses will always be translated to addresses in the 192.168.0.20−192.168.0.254 range from the global (outside) statement. The global (dmz) statement gives inside users access to the web server on the DMZ interface.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall

5-33

Command 6: route

pixfirewall(config)#

route if_name ip_address netmask gateway_ip [metric] • The route command defines a static or default route for an interface.

pixfirewall(config)# route outside 0.0.0.0 0.0.0.0 192.168.0.1 1

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-29

The syntax for the route command is as follows: route if_name ip_address netmask gateway_ip [metric] if_name

Describes the internal or external network interface name.

ip_address

Describes the internal or external network IP address. Use 0.0.0.0 to specify a default route. The 0.0.0.0 IP address can be abbreviated as 0.

netmask

Specifies a network mask to apply to ip_address. Use 0.0.0.0 to specify a default route. The 0.0.0.0 netmask can be abbreviated as 0.

gateway_ip

Specifies the IP address of the gateway router (the next hop address for this route).

metric

Specifies the number of hops to gateway_ip. If you are not sure, enter 1. Your WAN administrator can supply this information or you can use a traceroute command to obtain the number of hops. The default is 1 if a metric is not specified.

All routes entered using the route command are stored in the configuration when it is saved. In the example shown in the figure, all outgoing packets are sent to the 192.168.1.1 router IP address. More than one route can be configured.

5-34

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Summary This section summarizes the information you learned in this chapter.

Summary • The PIX Firewall has four administrative access modes: unprivileged, privileged, configuration, and monitor. • Interfaces with a higher security level can access interfaces with a lower security level, while interfaces with a lower security level cannot access interfaces with a higher security level unless given permission. • Using the PIX Firewall general maintenance commands helps you to manage the PIX Firewall. The commands include: enable, write, show, and reload. • The primary commands necessary to configure the PIX Firewall are the following: nameif, interface, ip address, nat, global, and route. • The nat and global commands work together to hide internal IP addresses. © 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—5-31

Basic Configuration of the Cisco PIX Firewall

5-35

5-36

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Lab Exercise―Configure the PIX Firewall and Execute General Maintenance Commands Complete the following lab exercises to practice what you have learned in this chapter.

Objectives In this lab exercise, you will complete the following tasks: ■

Familiarize yourself with the general maintenance commands.

■

Configure basic PIX Firewall features to protect Internet access to an enterprise network.

■

Test and verify basic PIX Firewall operation.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall Lab 5-1

Visual Objective The following illustration displays the lab topology for your classroom environment. You will use the IP addresses in this visual objective for the remainder of the course.

Lab Visual Objective Internet

Pod perimeter router .1 192.168.P.0/24 e0 outside .2 172.16.P.0/24

PIX Firewall

.2

e2 dmz .1 Bastion host, web and FTP server

e1 inside .1

10.0.P.0 /24 .3 172.26.26.50 Backbone, web, FTP, and TFTP server

© 2002, Cisco Systems, Inc.

Inside host, web and FTP server

www.cisco.com

CSPFA 2.1—5-33

Setup Before starting this lab exercise, make sure the PIX Firewall is turned on and that the PC is connected to the PIX Firewall.

Directions You will assign IP addresses and review all entries. You will also execute general maintenance commands necessary for proper PIX Firewall operation. Substitute your pod number wherever you see the letter P. Perform the following steps in this lab exercise: ■

View the default configuration of the PIX Firewall.

■

Answer written lab questions.

■

Configure the PIX Firewall interfaces.

■

Test the inside, outside, and DMZ interface connectivity.

■

Configure global addresses, NAT, and routing for inside and outside interfaces.

Lab 5-2 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Task 1—Execute General Commands To familiarize yourself with the general maintenance commands, complete the following. Step 1

The instructor will provide you with the procedures for access to the PIX Firewall console port, as this will vary according to your lab connectivity. After you access the PIX Firewall console port, the PIX Firewall prompt appears. pixfirewall>

Step 2

Display the list of help commands: pixfirewall> ?

Q 1) What is the first command available? A) enable Step 3

Enter the privileged mode of the PIX Firewall. When prompted for a password press Enter. pixfirewall> enable password: pixfirewall#

Step 4

Display the list of help commands at this point: pixfirewall# ?

Q 2) What is the first command available? Step 5

A) arp Use the write terminal command to display the PIX Firewall configuration to the terminal screen: pixfirewall# write terminal

Q 3) Look at the default values on the terminal screen and fill out the following table. Ethernet 0

Ethernet 1

Ethernet 2

Interface Name

outside

inside

intf2

Security Level

0

100

10

Step 6

Enter the show memory command: pixfirewall# show memory

Q 4) What information is shown on the terminal screen? Step 7

A) 67108864 bytes total, 50589696 bytes free Enter the show version command: pixfirewall# show version

Q 5) What information is shown on the terminal screen? A) Cisco Secure PIX Firewall Version 5.3(1) Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall Lab 5-3

Step 8

Enter the show history command: pixfirewall# show history

Q 6) What information is shown on the terminal screen? A) enable B) write terminal C) show memory D) show version E) show history Step 9

Enter the configuration mode and change the hostname to pixP (where P = pod number) using the hostname command: pixfirewall# configure terminal pixfirewall(config)# pixfirewall(config)# hostname pixP pixP(config)# exit pixP# write memory

Task 2—Configure PIX Firewall Interfaces To configure PIX Firewall Ethernet interfaces, complete the following steps: Step 1

Change to configuration mode: pixP# configure terminal

Step 2

Assign the PIX Firewall DMZ interface a name (dmz) and security level (50): pixP(config)# nameif e2 dmz security50 pixP(config)# show nameif nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security50 nameif ethernet3 intf3 security15 nameif ethernet4 intf4 security20 nameif ethernet5 intf5 security25

Step 3

Enable the Ethernet 0, Ethernet 1, and Ethernet 2 interfaces for 100 Mbps Ethernet full duplex communication. Note

By default the interfaces are disabled. You must enable all interfaces you intend to use.

pixP(config)# interface e0 100full pixP(config)# interface e1 100full pixP(config)# interface e2 100full pixP(config)# show interface interface ethernet0 "outside" is up, line protocol is up Hardware is i82558 ethernet, address is 0090.2724.fd0f IP address 127.0.0.1, subnet mask 255.255.255.255 MTU 1500 bytes, BW 10000 Kbit half duplex Lab 5-4 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier interface ethernet1 "inside" is up, line protocol is up Hardware is i82558 ethernet, address is 0090.2716.43dd IP address 127.0.0.1, subnet mask 255.255.255.255 MTU 1500 bytes, BW 100000 Kbit full duplex 184 packets input, 15043 bytes, 0 no buffer Received 179 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier interface ethernet2 "dmz" is up, line protocol is up Hardware is i82558 ethernet, address is 0090.2725.060d IP address 127.0.0.1, subnet mask 255.255.255.255 MTU 1500 bytes, BW 10000 Kbit half duplex 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier interface ethernet3 "intf3" is administratively down, line protocol is down Hardware is i82558 ethernet, address is 0090.2716.43dc IP address 127.0.0.1, subnet mask 255.255.255.255 MTU 1500 bytes, BW 100000 Kbit full duplex 184 packets input, 15043 bytes, 0 no buffer Received 179 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier interface ethernet4 "intf4" is administratively down, line protocol is down Hardware is i82558 ethernet, address is 0090.2716.43db IP address 127.0.0.1, subnet mask 255.255.255.255 MTU 1500 bytes, BW 100000 Kbit full duplex 184 packets input, 15043 bytes, 0 no buffer Received 179 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier interface ethernet5 "intf5" is administratively down, line protocol is down Hardware is i82558 ethernet, address is 0090.2716.43da

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall Lab 5-5

IP address 127.0.0.1, subnet mask 255.255.255.255 MTU 1500 bytes, BW 100000 Kbit full duplex 184 packets input, 15043 bytes, 0 no buffer Received 179 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier

Step 4

Assign IP addresses to the inside, outside, and DMZ network interface cards. Insert your pod number wherever you see the letter P: pixP(config)# ip address outside 192.168.P.2 255.255.255.0 pixP(config)# ip address inside 10.0.P.1 255.255.255.0 pixP(config)# ip address dmz 172.16.P.1 255.255.255.0

(where P = pod number) Step 5

Ensure that the IP addresses are correctly configured and are associated with the proper network interface: pixP(config)# show ip address System IP Addresses: ip address outside 192.168.P.2 255.255.255.0 ip address inside 10.0.P.1 255.255.255.0 ip address dmz 172.16.P.1 255.255.255.0 ip address intf3 127.0.0.1 255.255.255.255 ip address intf4 127.0.0.1 255.255.255.255 ip address intf5 127.0.0.1 255.255.255.255 Current IP Addresses: ip address outside 192.168.P.2 255.255.255.0 ip address inside 10.0.P.1 255.255.255.0 ip address dmz 172.16.P.1 255.255.255.0 ip address intf3 0.0.0.0 0.0.0.0 ip address intf4 0.0.0.0 0.0.0.0 ip address intf5 0.0.0.0 0.0.0.0

Step 6

Write the configuration to the Flash memory: pixP(config)# write memory Building configuration... Cryptochecksum: d4d9ae69 9f7c734c babeef58 54b69c91

Lab 5-6 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Task 3—Configure Global Addresses, NAT, and Routing for Inside and Outside Interfaces To configure a global address pool, NAT, and routing, complete the following steps: Step 1

Assign one pool of NIC-registered IP addresses for use by outbound connections: pixP(config)# global (outside) 1 192.168.P.20-192.168.P.254 netmask 255.255.255.0 pixP(config)# show global

global (outside) 1 192.168.P.20-192.168.P.254 netmask 255.255.255.0 (where P = pod number) Step 2

Configure the PIX Firewall to allow all inside hosts to use NAT for outbound access: pixP(config)# nat (inside) 1 0 0

Step 3

Display the currently configured NAT: pixP(config)# show nat nat (inside) 1 0.0.0.0 0.0.0.0 0 0

Step 4

Assign a default route: pixP(config)# route outside 0 0 192.168.P.1

Step 5

Display the currently configured routes: pixP(config)# show route outside 0.0.0.0 0.0.0.0 192.168.P.1 1 OTHER static inside 10.0.P.0 255.255.255.0 10.0.P.1 1 CONNECT static dmz 172.16.P.0 255.255.255.0 172.16.P.1 1 CONNECT static outside 192.168.P.0 255.255.255.0 192.168.P.2 1 CONNECT static

Step 6

Write the current configuration to Flash memory: pixP(config)# write memory

Step 7

Display a list of the most recently entered commands: Your history inputs should be similar to the following: pixP(config)# show history interface e0 100full interface e1 100full interface e2 100full show interface ip address outside 192.168.P.2 255.255.255.0 ip address inside 10.0.P.1 255.255.255.0 ip address dmz 172.16.P.1 255.255.255.0 show ip address write memory exit configure terminal global (outside) 1 192.168.P.20-192.168.P.254 netmask 255.255.255.0 show global nat (inside) 1 0 0 show nat

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall Lab 5-7

route outside 0 0 192.168.P.1 show route write memory show history

Note

Step 8

You can use the up and down cursor keys on your keyboard to recall commands.

Write the current configuration to the terminal and verify that you have entered the previous commands correctly: pixP(config)# write terminal Building configuration... : Saved : PIX Version 5.3(1) nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security50 nameif ethernet3 intf3 security15 nameif ethernet4 intf4 security20 nameif ethernet5 intf5 security25 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pix(P)l fixup protocol ftp 21 fixup protocol http 80 fixup protocol smtp 25 fixup protocol h323 1720 fixup protocol rsh 514 fixup protocol sqlnet 1521 fixup protocol sip 5060 names pager lines 24 no logging timestamp no logging standby no logging console no logging monitor no logging buffered no logging trap logging facility 20 logging queue 512 interface ethernet0 100full interface ethernet1 100full interface ethernet2 100full interface ethernet3 auto shutdown interface ethernet4 auto shutdown interface ethernet5 auto shutdown mtu outside 1500 mtu inside 1500 mtu dmz 1500 mtu intf3 1500 mtu intf4 1500 mtu intf5 1500

Lab 5-8 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

ip address outside 192.168.P.2 255.255.255.0 ip address inside 10.0.P.1 255.255.255.0 ip address dmz 172.16.P.1 255.255.255.0 ip address intf3 127.0.0.1 255.255.255.255 ip address intf4 127.0.0.1 255.255.255.255 ip address intf5 127.0.0.1 255.255.255.255 ip audit info action alarm ip audit attack action alarm no failover failover timeout 0:00:00 failover poll 15 failover ip address outside 0.0.0.0 failover ip address inside 0.0.0.0 failover ip address dmz 0.0.0.0 failover ip address intf3 0.0.0.0 failover ip address intf4 0.0.0.0 failover ip address intf5 0.0.0.0 arp timeout 14400 global (outside) 1 192.168.P.20-192.168.P.254 netmask 255.255.255.0 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 route outside 0.0.0.0 0.0.0.0 192.168.P.1 1 timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si p 0:30:00 sip media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable no sysopt route dnat isakmp identity hostname telnet timeout 5 ssh timeout 5 terminal width 80 Cryptochecksum:9963c491006b1296815f3437947fab81 : end [OK]

Step 9

Test the operation of the globals and NAT statements you configured by originating connections through the PIX Firewall: 1. Open a web browser on the Windows NT server. 2. Use the web browser to access the super server at IP address 172.26.26.50 by entering http://172.26.26.50.

Step 10 Observe the translation table: pixP(config)# show xlate

Your display should appear similar to the following: global 192.168.P.20 Local 10.0.P.3

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall Lab 5-9

A global address chosen from the low end of the global range has been mapped to your NT laptop.

Task 4—Test the Inside, Outside, and DMZ Interface Connectivity To test and troubleshoot interface connectivity using the PIX Firewall ping command, complete the following steps: Step 1

Ping the inside interface: pixP(config)# ping 10.0.P.1 10.0.P.1 response received —— 10ms 10.0.P.1 response received —— 10ms 10.0.P.1 response received —— 10ms

(where P = pod number) Step 2

Ping your inside host: pixP(config)# ping 10.0.P.3 10.0.P.3 response received —— 10ms 10.0.P.3 response received —— 10ms 10.0.P.3 response received —— 10ms

(where P = pod number) Step 3

Ping the outside interface: pixP(config)# ping 192.168.P.2 192.168.P.2 response received —— 10ms 192.168.P.2 response received —— 10ms 192.168.P.2 response received —— 10ms

(where P = pod number) Step 4

Ping your pod perimeter router: pixP(config)# ping 192.168.P.1 192.168.P.1 response received —— 10ms 192.168.P.1 response received —— 10ms 192.168.P.1 response received —— 10ms

(where P = pod number) Step 5

Ping the DMZ interface: pixP(config)# ping 172.16.P.1 172.16.P.1 response received —— 10ms 172.16.P.1 response received —— 10ms 172.16.P.1 response received —— 10ms

(where P = pod number) Step 6

Ping your bastion host: pixP(config)# ping 172.16.P.2 172.16.P.2 response received —— 10ms 172.16.P.2 response received —— 10ms 172.16.P.2 response received —— 10ms

Lab 5-10 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

(where P = pod number)

Completion Criteria You completed this lab exercise if you were able to ping the inside interface, outside interface, and DMZ interface.

Copyright  2002, Cisco Systems, Inc.

Basic Configuration of the Cisco PIX Firewall Lab 5-11

Lab 5-12 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

6

Cisco PIX Firewall Translations

Overview This chapter includes the following topics: ■

Objectives

■

Transport protocols

■

PIX Firewall translations

■

Access through the PIX Firewall

■

Other ways through the PIX Firewall

■

Summary

■

Lab exercise

Objectives This section lists the chapter’s objectives.

Objectives Upon completion of this chapter, you will be able to perform the following tasks: • Describe how the TCP and UDP protocols function within the PIX Firewall. • Describe how static and dynamic translations function. • Configure inbound and outbound access through the PIX Firewall. • Test and verify correct PIX Firewall operation.

© 2002, Cisco Systems, Inc.

6-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—6-2

Copyright  2002, Cisco Systems, Inc.

Transport Protocols To gain a deeper understanding of how the Cisco PIX Firewall processes inbound and outbound transmissions, a brief review of the two primary transport protocols is warranted.

Sessions in an IP World In an IP world, a network session is a transaction between two end systems. It is carried out over two transport layer protocols: • TCP (Transmission Control Protocol) • UDP (User Datagram Protocol)

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-4

It is important to understand the transport protocols TCP and UDP to understand how the PIX Firewall operates. This section aids in understanding the TCP and UDP protocols. A network session is carried out over two transport layer protocols: ■

TCP, which is easy to inspect

■

UDP, which is difficult to inspect properly

Note

Copyright  2002, Cisco Systems, Inc.

In the context of this training, the term outbound means connections from a more trusted side of the PIX Firewall to a less trusted side of the PIX Firewall. The term inbound means connections from a less trusted side of the PIX Firewall to a more trusted side of the PIX Firewall.

Cisco PIX Firewall Translations

6-3

TCP • TCP is a connection-oriented, reliable-delivery, robust, and high performance transport layer protocol. • TCP features – Sequencing and acknowledgement of data – A defined state machine (open connection, data flow, retransmit, close connection) – Congestion management and avoidance mechanisms © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-5

TCP is a connection-oriented protocol. When a session from a more secure host inside the PIX Firewall is started, the PIX Firewall creates a log in the session state filter. The PIX Firewall is able to extract network sessions from the network flow and actively verify their validity in real time. This stateful filter maintains the parameters (or state) of each network connection and checks subsequent protocol units against its expectations. When TCP initiates a session with the PIX Firewall, the PIX Firewall records the network flow and looks for an acknowledgement from the device with which it is trying to initiate communications. The PIX Firewall then allows traffic to flow between the connections based on the three-way handshake.

6-4

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

TCP Initialization—Inside to Outside Private network The PIX Firewall checks for Source addr Destination addr Source port

10.0.0.3 10.0.0.3 172.30.0.50 172.30.0.50 1026 1026

Destination port Initial sequence #

23 23 49091 49091

Ack

#1

Flag

10.0.0.3

Public network 192.168.0.20 192.168.0.20 172.30.0.50 172.30.0.50 1026 1026 23 23 49769 49769

#2

Syn Syn

172.30.0.50

Start the embryonic connection counter

172.30.0.50 172.30.0.50 10.0.0.3 10.0.0.3 23 23 1026 1026

IP header

92513 92513

TCP header

49092 49092 Syn-Ack Syn-Ack

© 2002, Cisco Systems, Inc.

PIX Firewall

Syn Syn

No data

#4

a translation slot. If one is not found, it creates one after verifying NAT, global, access control, and authentication or authorization, if any. If OK, a connection is created.

172.30.0.50 172.30.0.50

The PIX Firewall follows the Adaptive Security Algorithm: • (Src IP, Src Port, Dest IP, Dest Port ) check • Sequence number check • Translation check If the code bit is not syn-ack, PIX drops the packet.

#3

192.168.0.20 192.168.0.20 23 23 1026 1026 92513 92513 49770 49770 Syn-Ack Syn-Ack

www.cisco.com

CSPFA 2.1—6-6

When a TCP session is established over the PIX Firewall, the following happens: 1. The first IP packet from an inside host causes the generation of a translation slot. The embedded TCP information is then used to create a connection slot in the PIX Firewall. 2. The connection slot is marked as embryonic (not established yet). 3. The PIX Firewall randomizes the initial sequence number of the connection, stores the delta value, and forwards the packet onto the outgoing interface. 4. The PIX Firewall now expects a SYN/ACK packet from the destination host. Then the PIX Firewall matches the received packet against the connection slot, computes the sequencing information, and forwards the return packet to the inside host.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-5

TCP Initialization—Inside to Outside (cont.) Private network 10.0.0.3 10.0.0.3

Source addr Destination addr

172.30.0.50 172.30.0.50 1026 1026

Source port Destination port

23 23

Initial sequence #

49092 49092

Ack

92514 92514

Flag

Ack Ack

#5

Public network Reset the embryonic counter for this client. It then increments the connection counter for this host.

192.168.0.20 192.168.0.20 172.30.0.50 172.30.0.50 1026 1026 23 23 49770 49770

PIX Firewall

92514 92514 Ack Ack

#6 172.30.0.50

10.0.0.3 Data flows

Strictly follows the Adaptive Security Algorithm

IP header TCP header

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-7

5. The inside host completes the connection setup (the three-way handshake) with an ACK. 6. The connection slot on the PIX Firewall is marked as connected (activeestablished) and data is transmitted. The embryonic counter is then reset for this connection.

6-6

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

UDP

• Connectionless protocol • Efficient protocol for some services • Resourceful but difficult to secure

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-8

UDP is “connectionless.” The PIX Firewall must take other measures to ensure its security. Applications using UDP are difficult to secure properly because there is no handshaking or sequencing. It is difficult to determine the current state of a UDP transaction (opening, established, and closing). It is also difficult to maintain the state of a session, as it has no clear beginning, flow state, or end. However, the PIX Firewall creates a UDP connection slot when a UDP packet is sent from a more secure to a less secure interface. All subsequent returned UDP packets matching the connection slot are forwarded to the inside network.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-7

UDP (cont.) Private network The PIX Firewall checks for Source addr Destination addr

10.0.0.3 10.0.0.3 172.30.0.50 172.30.0.50

Source port

1028 1028

Destination port

45000 45000

a translation slot. If one is not found, it creates one after verifying NAT, global, access control, and authentication or authorization, if any. If OK, a connection is created.

Public network 192.168.0.20 192.168.0.20 172.30.0.50 172.30.0.50 1028 1028 45000 45000

PIX Firewall

#1

#2

10.0.0.3

172.30.0.50 All UDP responses arrive from outside and within UDP user-configurable timeout. (default=2 minutes)

#4 172.30.0.50 172.30.0.50 10.0.0.3 10.0.0.3 45000 45000 1028 1028

The PIX Firewall follows the Adaptive Security Algorithm: • (Src IP, Src Port, Dest IP, Dest Port ) check • Translation check

#3 172.30.0.50 172.30.0.50 192.168.0.20 192.168.0.20 45000 45000 1028 1028

IP header TCP header © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-9

When the UDP connection slot is idle for more than the configured idle time, it is deleted from the connection table. The following are some UDP characteristics: ■

UDP is an unreliable but efficient transport protocol.

■

Spoofing UDP packets is very easy (no handshaking or sequencing). As there is no state machine, the initiator of the transaction or the current state usually cannot be determined.

■

UDP has no delivery guarantees.

■

There is no connection setup and termination (application implements a state machine).

■

UDP has no congestion management or avoidance.

Services that use UDP can be generally divided into two categories:

6-8

■

Request-reply (ping-pong) services (DNS)

■

Flow services (video, VoIP, NFS)

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

PIX Firewall Translations This section describes the translation process in the PIX Firewall. There are two types of translations: static and dynamic.

Static Translations Internet Perimeter router 192.168.0.1 192.168.0.2 PIX Firewall 10.0.0.1 10.0.0.10 DNS Server

pixfirewall(config)# static (inside, outside) 192.168.0.18 10.0.0.10 • Packet from 10.0.0.10 has source address of 192.168.0.18 • Permanently maps a single IP address • Recommended for internal service hosts like a DNS server

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-11

Use static translations when you want an inside host to always appear with a fixed address on the PIX Firewall’s global network. Static translations are used to map an inside host address to an outside, global address: ■

Use the static command for outbound connections to ensure packets leaving an inside host are always mapped to a specific global IP address (for example, an inside DNS or SMTP host).

■

Use the static command alone for outbound connections that must be mapped to the same global IP address.

The following information can help you determine when to use static translations in the PIX Firewall: ■

Do not create statics with overlapping IP addresses. Each IP address should be unique.

■

Statics take precedence over nat and global command pairs.

■

If a global IP address will be used for port address translation (PAT), do not use the same global IP address for a static translation.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-9

Dynamic Translations • Configures dynamic translations – nat (inside) 1 0.0.0.0 0.0.0.0 – global (outside) 1 192.168.0.20-192.168.0.254 netmask 255.255.255.0

Internet

192.168.0.1

192.168.0.2 10.0.0.1

Global Global Pool Pool 192.168.0.20-192.168.0.254

10.0.0.3

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-12

Dynamic translations are used for local hosts and their outbound connections, and hide the host address from the Internet. With dynamic translations, you must first define which hosts are eligible for translation with the nat command, and then define the address pool with the global command. The pool for address allocation is chosen on the outgoing interface based on the nat_id selected with the nat command. The nat command works with the global command to enable NAT. The nat command associates a network with a pool of global IP addresses. It lets you specify lists of inside hosts that can use the PIX Firewall for address translation. In the figure above the global pool of addresses assigned by the global command is 192.168.0.20 through 192.168.0.254, enabling up to 235 individual IP addresses.

6-10

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Connections vs. Translations

• Translations—xlate – IP address to IP address translation – 65,536 translations supported • Connections—conns – TCP or UDP sessions

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-13

Translations are at the IP layer and connections are at the transport layer (TCP specifically). Connections are subsets of translations. You can have many connections open under one translation. You can specify up to 256 global pools of IP addresses. The maximum is one class B network worth of IP addresses, or 255 class C addresses—that is, 65,535 addresses.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-11

xlate Command pixfirewall(config)#

clear xlate [global_ip [local_ip]]

• The clear xlate command clears the contents of the translation slots.

www.cisco.com

© 2002, Cisco Systems, Inc.

CSPFA 2.1—6-14

The xlate command enables you to show or clear the contents of the translation (xlate) slots. Translation slots can remain indefinitely after key changes have been made. Always use clear xlate or reload after adding, changing, or removing alias, conduit, global, nat, route, or static commands in your configuration. The syntax for the xlate command is as follows: clear xlate [global_ip [local_ip]] show xlate [global_ip [local_ip]] global_ip

The registered IP address to be used from the global pool.

local_ip

The local IP address from the inside network.

Note

6-12

See the Configuration Guide for the PIX Firewall for a description of the xlate and conn fields displayed with the show xlate command.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Access Through the PIX Firewall This section explains how to gain access through the PIX Firewall.

Only Two Ways Through the PIX Firewall

• Valid user request – Inside to outside communications • Pre-defined static and conduit – Outside to inside communications – Defines addresses, ports, and applications

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-16

There are only two ways to gain access through the PIX Firewall: ■

Valid user request—All inside-to-outside-originated sessions first dynamically populate the translation table. When an outside server responds to the request, the PIX Firewall checks the translation table to see if a translation slot exists for that particular request. If it exists, the PIX Firewall allows the session to continue through. After the session is terminated, the translation slot is deleted. After a session is established for UDP requests, a configurable timer is set. The session finishes based on the time allowed for the UDP session and then closes the translation slot.

■

Copyright  2002, Cisco Systems, Inc.

Predefined statics and conduits—Used for outside to inside communication. A pre-defined static translation is entered using an address or range of addresses from the global pool. A conduit is entered that defines the address, group of addresses, TCP/UDP port or range of ports, and who and what applications are allowed to flow through the PIX Firewall.

Cisco PIX Firewall Translations

6-13

Statics and Conduits • The static and conduit commands allow connections from a lower security interface to a higher security interface. • The static command is used to create a permanent mapping between an inside IP address and a global Outside IP address. Security 0 • The conduit command is an exception in the ASA’s inbound security policy for a given host. © 2002, Cisco Systems, Inc.

www.cisco.com

Inside Security 100

CSPFA 2.1—6-17

Although most connections occur from an interface with a high security level to an interface with a low security level, there are times when you will want to allow connections from an interface with a lower security level to an interface with a higher security level. To do this, use the static and conduit commands. The static command creates static mapping between an inside IP address and a global IP address. Using the static command enables you to set a permanent global IP address for a particular inside IP address. This creates an entrance for the specified interfaces with the lower security level into the specified interface with a higher security level. After creating a static mapping between an inside IP address and a global IP address by using the static command, the connection from the outside interface to the inside interface is still blocked by the PIX Firewall’s Adaptive Security Algorithm (ASA). The conduit command is used to allow traffic to flow between interfaces. The conduit command creates the exceptions to the PIX Firewall’s ASA. Note

6-14

When you use a static command, you must also use a conduit command. The static command makes the mapping, and the conduit command lets users access the static mapping.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

static Command pixfirewall(config)#

static [(internal_if_name, external_if_name)] global_ip local_ip [netmask network_mask][max_conns[em_limit]][norandomseq] • Maps a local IP address to a global IP address

pixfirewall(config)# static (inside,outside) 192.168.0.10 10.0.0.3 netmask 255.255.255.255 0 1000 • Packet sent from 10.0.0.3 has a source address of 192.168.0.10 • Permanently maps a single IP address • Recommended for internal service hosts

Perimeter router 192.168.0.1 192.168.0.2

PIX Firewall 10.0.0.1

10.0.0.3 © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-18

The static command creates a permanent mapping (called a static translation slot or xlate) between a local IP address and a global IP address. For outbound connections, use static to specify an address in the pool of global addresses that is always used for translation between the local host and the global address. For inbound connections, use static with the conduit command to identify addresses visible on the external network. The static command creates a permanent mapping (static translation slot) between a local IP address and a NIC-registered IP address. In the example above, when a packet from the client station 10.0.0.3 goes out through the PIX Firewall, it will have the source IP address of 192.168.0.10. Connections to 192.168.0.10 are unlimited, but embryonic connections are limited to 1000. The syntax for the static command is as follows: static [(internal_if_name, external_if_name)] global_ip local_ip [netmask network_ mask] [max_conns[em_limit]][norandomseq] internal_if_name

The internal network interface name.

external_if_name

The external network interface name.

global_ip

The global IP address used for redirection.

local_ip

The local IP address from the inside network.

netmask

Reserve word required before specifying the network mask.

mask

The network mask pertains to both global_ip and local_ip.

max_conns

The maximum number of connections permitted through the static at the same time.

emb_limit

The embryonic connection limit. An embryonic connection is one that has started but not yet completed. Set this limit to prevent attack by a flood of embryonic connections. The default is 0, which

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-15

means unlimited connections. norandomseq

Do not randomize the TCP/IP packet's sequence number. Only use this option if another inline firewall is also randomizing sequence numbers and the result is scrambling the data. Use of this option opens a security hole in the PIX Firewall.

The security level for each interface is set by the nameif command. The static command allows traffic to originate from an interface with a lower security value through the PIX Firewall to an interface with a higher security value. For example, a static and conduit must be configured to allow incoming sessions from the outside interface to the DMZ interface, or from the outside interface to the inside interface. Statics take precedence over nat and global command pairs. Use the show static command to view static statements in the configuration. In software versions 5.2 and higher, for all inbound traffic, the PIX Firewall denies translations for destination IP addresses identified as network address or broadcast addresses. It uses the global IP and mask from a static command statement to differentiate regular IP addresses from network or broadcast addresses. If a global IP address is a valid network address with a matching network mask, then the PIX Firewall disallows the xlate for network or broadcast IP addresses with inbound packet.

6-16

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

conduit Command pixfirewall(config) #

conduit permit|deny protocol global_ip global_mask [operator port[port]] foreign_ip foreign_mask[operator port[port]] • A conduit maps specific IP address and TCP/UDP connection from the outside host to the inside host Perimeter router 192.168.0.1

pixfirewall(config)# conduit permit tcp host 192.168.0.10 eq ftp any

192.168.0.2 PIX Firewall 10.0.0.1

10.0.0.3

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-19

The conduit command permits or denies connections from outside the PIX Firewall to access TCP/UDP services on hosts inside the network. The conduit statement creates an exception to the PIX Firewall ASA by permitting connections from one PIX Firewall network interface to access hosts on another. To allow connections from a lower security interface to a higher security interface, the conduit command must be used. The conduit command is what actually creates an exception to the standard PIX Firewall ASA. The example above allows FTP services via the IP address 192.168.0.10 to the inside host 10.0.0.3 from the outside. The global_ip and global_mask define the IP address or addresses where connections are being permitted. You can have up to 8000 conduits, and can remove a conduit with the no conduit command. The syntax for the conduit command is as follows: conduit permit | deny protocol global_ip global_mask [operator port [port]] foreign_ip foreign_mask [operator port [port]] permit

Permits access if the conditions are met.

deny

Denies access if the conditions are met.

protocol

Specifies the transport protocol for the connection. Possible literal values are eigrp, gre, icmp, igmp, grp, ip, ipinip, nos, ospf, tcp, udp, or an integer in the range 0 to 255 representing an IP protocol number. Use ip to specify all transport protocols. You can view valid protocol numbers online at: //www.isi.edu/innotes/iana/assignments/protocol-numbers.

icmp

Permit or deny ICMP access to one or more global IP addresses. Specify the ICMP type in the icmp_type variable, or omit to specify all ICMP types.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-17

global_ip

A global IP address previously defined by a global or static command. You can use any IP address if the global_ip and global_mask are 0.0.0.0 0.0.0.0. The any command applies the permit or deny to the global addresses on all interfaces. If global_ip is a host, you can omit global_mask by specifying the host command before global_ip.

operator

A comparison operand that enables you to specify a port or a port range. Possible values are: eq, lt, any, gt, neq, range. Use the no operator and port to indicate all ports.

global_mask

Network mask of global_ip. The global_mask is a 32-bit, 4-part dotted decimal; for example, 255.255.255.255. Use zeros to indicate bit positions to be ignored. Use subnetting if required. If you use 0 for global_ip, use 0 for the global_mask; otherwise, enter the global_mask appropriate to global_ip.

port

Service you permit to be used while accessing global_ip. Specify services by the port that handles it, such as 25 for SMTP, 80 for HTTP, and so on. 0 means any port. The port values are defined in RFC 1700. Permitted literal names are dns, esp, ftp, h323, http, ident, nntp, ntp, pop2, pop3, pptp, rpc, smtp, snmp, snmptrap, sqlnet, tcp, telnet, tftp, and udp. Note that you can specify literals in port ranges; for example, ftp-h323. You can also specify numbers.

foreign_ip

An external IP address (host or network) that can access the global_ip. You can specify 0.0.0.0 or 0 for any host. If both the foreign_ip and foreign_mask are 0.0.0.0 0.0.0.0, you can use the shorthand any command, which applies to all interfaces. If foreign_ip is a host, you can omit foreign_mask by specifying the host command before foreign_ip.

foreign_mask

Network mask of foreign_ip. The foreign_mask is a 32-bit, 4-part dotted decimal; for example, 255.255.255.255. Use zeros in a part to indicate bit positions to be ignored. Use subnetting if required. If you use 0 for foreign_ip, use 0 for the foreign_mask; otherwise, enter the foreign_mask appropriate to foreign_ip.

operator

A comparison operand that enables you to specify a port or a port range. Possible values are: eq, lt, any, gt, neq, range. Use the no operator and port to indicate all ports.

port

Service you permit to be used while accessing global_ip or foreign_ip. Specify services by the port that handles it, such as 25 for SMTP, 80 for HTTP, and so on. You can specify ports by either a literal name or as a number in the range of 0 to 65535. You can specify all ports by not specifying a port value, for example, conduit deny tcp any any. This command is the default condition for the conduit command in that all ports are denied until explicitly permitted. You can view valid port numbers online at the following: www.isi.edu/in-notes/iana/assignments/port-numbers

Note

6-18

If you want internal users to be able to ping external hosts, you must create an ICMP conduit for echo reply; for example, to give ping access to all hosts, use the conduit permit icmp any any command. However, this may cause a lot of traffic on busy networks.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Other Ways Through the PIX Firewall This section describes other ways through the PIX Firewall, such as Port Address Translation (PAT) and the xlate command.

Port Address Translation PAT PAT Global Global 192.168.0.15

10.0.0.2

Source addr

10.0.0.2

192.168.0.15 192.168.0.15

Source addr

Destination addr

172.30.0.50 172.30.0.50

172.30.0.50 172.30.0.50

Destination addr

Source port

49090

2000

Destination port

23

23 23

Source addr

10.0.0.3

192.168.0.15 192.168.0.15

Source addr

Destination addr

172.30.0.50 172.30.0.50

172.30.0.50 172.30.0.50

Destination addr

Source port

49090

2001

Source port

23 23

Destination port

Source port Destination port

Internet

10.0.0.3

Destination port

© 2002, Cisco Systems, Inc.

23

www.cisco.com

CSPFA 2.1—6-21

PAT is a combination of an IP address and a source port number, which creates a unique session. PAT uses the same IP address for all packets but a different unique source port greater than 1024. PAT provides the following advantages: ■

PAT and Network Address Translation (NAT) can be used together.

■

The PAT address can be different from the outside interface address.

■

Provides for IP address expansion.

■

One outside IP address used for up to 64,000 inside hosts.

■

Maps port numbers to single IP address.

■

PAT provides security by hiding the inside source address by using single IP address from the PIX Firewall.

In the figure above, two clients are requesting connectivity to the Internet. The PIX Firewall checks security rules to verify the security levels, and then replaces the source IP address with the PAT IP address. To maintain accountability, the source port address is changed to a unique number greater than 1024.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-19

PAT Example pixfirewall(config)# ip address (inside) 10.0.0.1 255.255.255.0 pixfirewall(config)# ip address (outside) 192.168.0.2 255.255.255.0 pixfirewall(config)# route (outside) 0.0.0.0 0.0.0.0 192.168.0.1

Perimeter router

pixfirewall(config)# global (outside) 1 192.168.0.9 netmask 255.255.255.0

192.168.0.1

pixfirewall(config)# nat (inside) 1 10.0.0.0 255.255.255.0 192.168.0.2

PIX Firewall 10.0.0.1 Engineering 10.0.1.0

• Assign a single IP address (192.168.0.9) to global pool

Bastion host 172.16.0.2

• IP addresses are typically registered with InterNIC

Sales

• Source addresses of hosts in network 10.0.0.0 are translated to 192.168.0.9 for outgoing access

10.0.2.0

Information systems © 2002, Cisco Systems, Inc.

• Source port changed to a unique number greater than 1024

www.cisco.com

CSPFA 2.1—6-22

The PIX Firewall PAT feature expands a company’s address pool: ■

One outside IP address is used for approximately 4,000 inside hosts (practical limit, theoretical limit is greater than 64,000).

■

Pat maps TCP port numbers to a single IP address.

■

PAT provides security by hiding the inside source address by using a single IP address from the PIX.

■

PAT can be used with NAT.

■

A PAT address can be a virtual address, different from the outside address. Do not use PAT when running multimedia applications through the PIX Firewall. Multimedia applications need access to specific ports and can conflict with port mappings provided by PAT.

In this example of PAT, XYZ Company has only four registered IP addresses. One address is taken by the perimeter router, one by the PIX Firewall, and one by the bastion host. The example configuration is as follows: ip address (inside) 10.0.0.1 255.255.255.0 ip address (outside) 192.168.0.2 255.255.255.0 route (outside) 0.0.0.0 0.0.0.0 192.168.0.1

IP addresses are assigned to the internal and external interfaces. A single registered IP address is put into the global pool, and is shared by all outgoing access for network 10.0.0.0: global (outside) 1 192.168.0.9 netmask 255.255.255.0 nat (inside) 1 10.0.0.0 255.255.255.0

6-20

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

PAT Using Outside Interface Address pixfirewall(config)# ip address (inside) 10.0.0.1 255.255.255.0 pixfirewall(config)# ip address (outside) 192.168.0.2 255.255.255.0 Perimeter router

192.168.0.1

pixfirewall(config)# route (outside) 0.0.0.0 0.0.0.0 192.168.0.1 pixfirewall(config)# global (outside) 1 interface pixfirewall(config)# nat (inside) 1 10.0.0.0 255.255.255.0 192.168.0.2

PIX Firewall 10.0.0.1 Engineering 10.0.1.0

Bastion host

• Use the interface option to enable use of the outside interface as the PAT address.

172.16.0.2 Sales

• Source addresses of hosts in network 10.0.0.0 are translated to 192.168.0.2 for outgoing access.

10.0.2.0

• The source port is changed to a unique number greater than 1024. Information systems

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-23

You can use the IP address of the outside interface as the PAT address by using the interface option of the global command. This is important for configuring DHCP, allowing for the DHCP retrieved address to be used for PAT. DHCP support will is discussed later in the course. In the figure, source addresses for hosts on network 10.0.0.0 are translated to 192.168.0.2 for outgoing access, and the source port is changed to a unique number greater than 1024. Note

Copyright  2002, Cisco Systems, Inc.

When PAT is enabled on an interface, there should be no loss of TCP, UDP, and ICMP services. These services allow for termination at the PIX Firewall unit's outside interface.

Cisco PIX Firewall Translations

6-21

Mapping Subnets to PAT Addresses pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# 255.255.255.0 pixfirewall(config)# 255.255.255.0 pixfirewall(config)# pixfirewall(config)#

Perimeter router 192.168.0.1

ip address (inside) 10.0.0.1 255.255.255.0 ip address (outside) 192.168.0.2 255.255.255.0 route (outside) 0.0.0.0 0.0.0.0 192.168.0.1 global (outside) 1 192.168.0.8 netmask global (outside) 2 192.168.0.9 netmask nat (inside) 1 10.0.1.0 255.255.255.0 nat (inside) 2 10.0.2.0 255.255.255.0

192.168.0.2 PIX Firewall 10.0.0.1 Engineering 10.0.1.0

• Map different internal subnets to different PAT addresses..

Bastion host 172.16.0.2

• Source addresses of hosts in network 10.0.1.0 are translated to 192.168.0.8 for outgoing access.

Sales 10.0.2.0

• Source addresses of hosts in network 10.0.2.0 are translated to 192.168.0.9 for outgoing access. Information systems

© 2002, Cisco Systems, Inc.

• The source port is changed to a unique number greater than 1024.

www.cisco.com

CSPFA 2.1—6-24

With software versions 5.2 and higher, you can specify multiple PATs to track usage among different subnets. In the figure, network 10.0.1.0 and network 10.0.2.0 are mapped to different PAT addresses. This is done by using a separate nat and global command pair for each network. Outbound sessions from hosts on internal network 10.0.1.0 will appear to originate from address 192.168.0.8, and outbound sessions from hosts on internal network 10.0.2.0 will appear to originate from address 192.168.0.9.

6-22

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Backing up PAT Addresses by Using Multiple PATs

Perimeter router 192.168.0.1

pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# 255.255.255.0 pixfirewall(config)# 255.255.255.0 pixfirewall(config)#

ip address (inside) 10.0.0.1 255.255.255.0 ip address (outside) 192.168.0.2 255.255.255.0 route (outside) 0.0.0.0 0.0.0.0 192.168.0.1 global (outside) 1 192.168.0.8 netmask global (outside) 1 192.168.0.9 netmask nat (inside) 1 10.0.1.0 255.255.255.0

192.168.0.2 PIX Firewall 10.0.0.1 Engineering 10.0.1.0

• Back up your PAT addresses by configuring another global.

Bastion host 172.16.0.2

• Source addresses of hosts in network 10.0.1.0 are translated to 192.168.0.8 for outgoing access.

Sales 10.0.2.0

• Address 192.168.0.9 will only be used when the port pool from 192.168.0.8 is at maximum capacity. Information systems

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-25

With software versions 5.2 and higher, you can also back up your PAT address by configuring multiple globals with the same nat_id. In the figure, address 192.168.0.9 will be used for all outbound connections from network 10.0.1.0 when the port pool from 192.168.0.8 is at maximum capacity.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-23

Augmenting a Global Pool with PAT

Perimeter router 192.168.0.1

pixfirewall(config)# ip address (inside) 10.0.0.1 255.255.255.0 pixfirewall(config)# ip address (outside) 192.168.0.2 255.255.255.0 pixfirewall(config)# route (outside) 0.0.0.0 0.0.0.0 192.168.0.1 pixfirewall(config)# global (outside) 1 192.168.0.20-192.168.0.254 netmask 255.255.255.0 pixfirewall(config)# global (outside) 1 192.168.0.19 netmask 255.255.255.0 pixfirewall(config)# nat (inside) 1 10.0.0.0 255.255.255.0 192.168.0.2

PIX Firewall 10.0.0.1 Engineering 10.0.1.0

• When hosts on the 10.0.0.0 network access the outside network through the firewall, they are assigned public addresses from the 192.168.0.20192.168.0.254 range.

Bastion host 172.16.0.2 Sales

• When the addresses from the global pool are exhausted, PAT begins.

10.0.2.0 10.0.0.0 Information systems

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-26

You can augment a pool of global addresses with PAT. When all IP addresses from the global pool are in use, the PIX Firewall begins PAT using the single IP address shown in the second global command. In the figure, hosts on the 10.0.0.0 internal network are assigned addresses from the global pool 192.168.0.20−192.168.0.254 as they initiate outbound connections. When the addresses from the global pool are exhausted, packets from all hosts on network 10.0.0.0 will appear to have originated from 192.168.

6-24

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Port Redirection pixfirewall(config)#

static [(internal_if_name, external_if_name)] {tcp|udp}{global_ip|interface}global-port local_ip local-port[netmask mask][max_conns[emb_limit [norandomseq]]] • Allows outside users to connect to a particular IP address or port and have the PIX redirect traffic to the appropriate inside server.

pixfirewall(config)# static (inside,outside) tcp 192.168.0.15 ftp 10.0.0.3 ftp netmask 255.255.255.255 0 0 • External users direct FTP requests to unique IP address 192.168.0.15. The PIX Firewall redirects the request to 10.0.0.3.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-27

With software versions 6.0 and higher, the PIX Firewall provides static PAT capability. This feature allows outside users to connect to a particular IP address or port and have the PIX Firewall redirect traffic to the appropriate inside server. This capability can be used to send multiple inbound TCP or UDP services to different internal hosts through a single global address. The shared global address can be a unique address or a shared outbound PAT address, or it can be shared with the external interface. The static command was modified in software version 6.0 to accommodate port redirection. If the tcp or udp keyword is specified in the static command, a static UDP or TCP port redirection is configured. If the interface keyword is specified, the outside interface address is taken to be the global IP address. Note

A conduit or access-list command statement must be configured in addition to the static command to enable an inbound connection.

The syntax for the static command is as follows: static [(internal_if_name, external_if_name)]{tcp|udp} {global_ip| interface} global-port local_ip local-port [netmask mask] [max_conns[emb_limit]][norandomseq] internal_if_name

The internal network interface name.

external_if_name

The external network interface name.

tcp

Specifies TCP port redirection.

udp

Specifies UDP port redirection.

global_ip

The global IP address used for redirection.

interface

The outside interface address taken to be the global address.

global-port

Global TCP or UDP port for port redirection.

local_ip

The local IP address from the inside network.

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-25

6-26

local-port

Local TCP or UDP port for port redirection.

netmask

Reserve word required before specifying the network mask.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Port Redirection Example telnet 192.168.0.2

Internet Perimeter router 192.168.0.1 192.168.0.2

http://192.168.0.9:8080

PIX Firewall

10.0.0.4

172.16.0.2 Web Server

10.0.0.1

10.0.0.3

pixfirewall(config)# static (inside,outside)tcp interface telnet 10.0.0.4 telnet netmask 255.255.255.255 0 0 pixfirewall(config)# static (inside,outside) tcp 192.168.0.9 8080 172.16.0.2 www netmask 255.255.255.255 0 0 • •

The external user directs a Telnet request to the PIX Firewall’s outside IP address, 192.168.0.2. The PIX Firewall redirects the request to host 10.0.0.4. The external user directs an HTTP port 8080 request to the PIX Firewall PAT address, 192.168.0.9. The PIX Firewall redirects this request to host 172.16.0.2 port 80.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-28

In the example above, the external user directs a Telnet request to the PIX outside IP address 192.168.0.2. The PIX Firewall redirects the request to host 10.0.0.4. The external user then directs an HTTP port 8080 request to PAT address 192.168.0.9. The PIX Firewall redirects this request to host 172.16.0.2 port 80. The following is a partial configuration for the PIX Firewall in the example: access-list 101 permit tcp any host 192.168.0.2 eq telnet access-list 101 permit tcp any host 192.168.0.9 eq 8080 access-group 101 in interface outside global (outside) 1 192.168.0.9 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside)tcp interface telnet 10.0.0.4 telnet netmask 255.255.255.255 0 0 static (inside,outside) tcp 192.168.0.9 8080 172.16.0.2 www netmask 255.255.255.255 0 0

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations

6-27

No Network Address Translation (nat 0) pixfirewall(config)# nat (inside) 0 192.168.0.9 255.255.255.255 pixfirewall(config)# show nat nat 0 192.168.0.9 will be non-translated

• nat 0 ensures that 192.168.0.9 is not translated. • ASA remains in effect with nat 0.

Perimeter router 192.168.0.1 192.168.0.2 PIX Firewall 10.0.0.1

192.168.0.9 © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-29

Another feature to control outbound connections is the ability to control which internal IP addresses are visible on the outside. The nat 0 command lets you disable address translation so that inside IP addresses are visible on the outside without address translation. Use this feature when you have NIC-registered IP addresses on your inside network that you want to be accessible on the outside network. Use of nat 0 depends on your security policy. If your policy allows for internal clients to have their IP addresses exposed to the Internet, then nat 0 is the process to provide that service. In the figure above, the address 192.168.0.9 is not translated. When you enter nat (inside) 0 192.168.0.9 255.255.255.255, the PIX Firewall displays the following message: nat 0 192.168.0.9 will be non-translated.

6-28

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Summary This section summarizes the tasks you learned to complete in this chapter.

Summary • The PIX Firewall manages the TCP and UDP protocols through the use of a translation table. • Static translations assign a permanent IP address to an inside host. Mapping between local and global addresses is done dynamically with the nat command. • The PIX Firewall understands the performance characteristics of the NetBIOS protocol and is able to translate the source address in the IP header as well as the source address in the payload.

© 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—6-31

Cisco PIX Firewall Translations

6-29

Summary (cont.)

• Dynamic translations use NAT for local clients and their outbound connections and hides the client address from others on the Internet. • The static and conduit commands are used to allow inbound communication through the PIX Firewall. • The PIX Firewall supports PAT, port redirection, and no network address translation (nat 0).

© 2002, Cisco Systems, Inc.

6-30

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—6-32

Copyright  2002, Cisco Systems, Inc.

Lab Exercise—Configuring Access Through the PIX Firewall Complete the following lab exercise to practice what you learned in this chapter.

Objectives In this lab exercise you will complete the following tasks: ■

Configure a PIX Firewall to protect an enterprise network from Internet access.

■

Test and verify correct PIX Firewall operation.

■

Configure the PIX Firewall third interface.

■

Test and verify access to the third interface.

Visual Objectives The following figure displays the configuration you will complete in this lab exercise.

Lab Visual Objective Internet

Pod perimeter router .1 192.168.P.0/24 e0 outside .2 172.16.P.0/24

PIX Firewall

.2

e2 dmz .1 Bastion host web and ftp server

e1 inside .1 10.0.P.0 /24 .3 172.26.26.50 Backbone server web, FTP, and TFTP server

© 2002, Cisco Systems, Inc.

Inside host web and FTP server

www.cisco.com

CSPFA 2.1—6-34

Directions Your task in this exercise is to configure the PIX Firewall to work with a perimeter router to protect the campus network from intruders. One PIX Firewall Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations Lab 6-1

is available for each pod group of two students. Work with your pod members to perform the following steps in this lab exercise: ■

Configure global addresses and NAT for inside and outside interfaces.

■

Test globals and NAT configuration.

■

Configure a static and conduit from the PIX Firewall outside interface to the Windows NT server inside the network.

■

Test and verify correct PIX Firewall operation.

■

Configure the PIX Firewall third interface.

■

Test access to the third interface.

Task 1—Configure Global Addresses and NAT for Inside and Outside Interfaces Enter the following commands to configure PIX Firewall global address pools and routing: Step 1

Remove NAT: pixP(config)# no nat (inside) 1 0 0

Step 2

Configure NAT for the internal network’s range of IP addresses: pixP(config)# nat (inside) 1 10.0.P.0 255.255.255.0 0 0

Step 3

Display currently configured NAT: pixP(config)# show nat nat (inside)1 10.0.P.0 255.255.255.0 0 0

Step 4

Allow ICMP and ping packets through the PIX Firewall: pixP(config)# conduit permit icmp any any

Step 5

Write the current configuration to Flash memory: pixP(config)# write memory

Step 6

Write the current configuration to the terminal: pixP(config)# write terminal

Step 7

Use the clear xlate command after configuring with the nat and global commands to make the global IP addresses available in the translation table: pixP(config)# clear xlate pixP(config)# show xlate

Task 2—Test Globals and NAT Configuration To test the globals and NAT configuration, you must complete the following: Step 1

From your Windows command line, ping the perimeter router. C:\> ping 192.168.P.1

Step 2

Test the operation of the global and NAT you configured by originating connections through the PIX Firewall.

Lab 6-2 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

1. Open a web browser on the Windows NT server. 2. Use the web browser to access the Super Server at IP address 172.26.26.50 by entering http://172.26.26.50. Step 3

Observe the translation table with the show xlate command. pixP(config)# show xlate

Your display should appear similar to the following: Global 192.168.P.20 Local 10.0.P.3

Note that a global address chosen from the low end of the global range has been mapped to your NT laptop.

Task 3—Configure a Static and Conduit from the PIX Firewall Outside Interface to the Windows NT Server Inside the Network Configure a static translation so that traffic originated from the internal Windows NT server always has the same source address on the outside interface of the PIX Firewall. Test the static and conduit by pinging the Windows NT server from the perimeter router. In a production environment, you should remove the conduit permit icmp any any command to prevent a potential security breach. Use the following commands: Step 1

Create a static translation from the outside PIX Firewall interface to the internal host, and create a conduit to allow web connections from the outside to your NT server on the inside: pixP(config)# static (inside,outside) 192.168.P.10 10.0.P.3 pixP(config)# conduit permit tcp host 192.168.P.10 eq www any

(where P = your pod number) Step 2

Turn on ICMP monitoring at the PIX Firewall: pixP(config)# debug icmp trace ICMP trace on Warning: this may cause problems on busy networks

Step 3

Clear the translation table: pixP(config)# clear xlate

Step 4

Ping the perimeter router from your Windows NT server to test the translation. Observe the source and destination of the packets at the console of the PIX Firewall. C:\> ping 192.168.P.1

(where P = pod number) Note the example display for pixP: Outbound Inbound Outbound Inbound Outbound Inbound Copyright  2002, Cisco Systems, Inc.

ICMP ICMP ICMP ICMP ICMP ICMP

echo echo echo echo echo echo

request 10.0.P.3 > 192.168.P.10 > 192.168.P.1 reply 192.168.P.1 > 192.168.P.10 > 10.0.P.3 request 10.0.P.3 > 192.168.P.10 > 192.168.P.1 reply 192.168.P.1 > 192.168.P.10 > 10.0.P.3 request 10.0.P.3 > 192.168.P.10 > 192.168.P.1 reply 192.168.P.1 > 192.168.P.10 > 10.0.P.3 Cisco PIX Firewall Translations Lab 6-3

Outbound ICMP echo request 10.0.P.3 > 192.168.P.10 > 192.168.P.1 Inbound ICMP echo reply 192.168.P.1 > 192.168.P.10 > 10.0.P.3

Observe the source, destination, and translated addresses on the PIX Firewall console. Step 5

Ping a peer inside host from your inside host as allowed by the conduit via the static: C:\> ping 192.168.Q.10

(where Q = peer pod number) Step 6

Test web access to another pod’s inside host as allowed by the static and conduit configured in this task. 1. Open a web browser on the Windows NT server. 2. Use the web browser to access the inside host of another pod by entering http://192.168.Q.10.

Step 7

Turn off debug: pixP(config)#no debug icmp trace

Example Configuration Your configuration may look as follows at this point: pixP(config)# write terminal Building configuration... : Saved : PIX Version 5.3(1) nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security50 nameif ethernet3 intf3 security15 nameif ethernet4 intf4 security20 nameif ethernet5 intf5 security25 enable password 6RD5.96v/eXN3kta encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pixP fixup protocol ftp 21 fixup protocol http 80 fixup protocol smtp 25 fixup protocol h323 1720 fixup protocol rsh 514 fixup protocol sqlnet 1521 fixup protocol sip 5060 names pager lines 24 no logging timestamp no logging console no logging monitor no logging buffered no logging trap logging facility 20 Lab 6-4 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

interface ethernet0 100full interface ethernet1 100full interface ethernet2 100full interface ethernet3 auto shutdown interface ethernet4 auto shutdown interface ethernet5 auto shutdown mtu outside 1500 mtu inside 1500 mtu dmz 1500 mtu intf3 1500 mtu intf4 1500 mtu intf5 1500 ip address outside 192.168.P.2 255.255.255.0 ip address inside 10.0.P.1 255.255.255.0 ip address dmz 172.16.P.1 255.255.255.0 ip address intf3 127.0.0.1 255.255.255.255 ip address intf4 127.0.0.1 255.255.255.255 ip address intf5 127.0.0.1 255.255.255.255 ip audit info action alarm ip audit attack action alarm no failover failover poll 15 failover timeout 0:00:00 failover ip address outside 0.0.0.0 failover ip address inside 0.0.0.0 failover ip address dmz 0.0.0.0 arp timeout 14400 global (outside) 1 192.168.P.20-192.168.P.254 netmask 255.255.255.0 nat (inside) 1 10.0.P.0 255.255.255.0 0 0 static (inside,outside) 192.168.P.10 10.0.P.3 netmask 255.255.255.255 0 0 conduit permit icmp any any conduit permit tcp host 192.168.P.10 eq www any route outside 0.0.0.0 0.0.0.0 192.168.P.1 1 timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si p 0:30:00 sip media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable no sysopt route dnat isakmp identity hostname telnet timeout 5 ssh timeout 5 terminal width 80 Cryptochecksum:9963c491006b1296815f3437947fab81 : end [OK OK] OK

Copyright  2002, Cisco Systems, Inc.

Cisco PIX Firewall Translations Lab 6-5

Lab 6-6 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

7

Configuring Multiple Interfaces

Overview This chapter includes the following topics: ■

Objectives

■

Configuring additional interfaces

■

Summary

■

Lab exercise

Objectives This section lists the chapter’s objectives.

Objectives

Upon completion of this chapter, you will be able to perform the following tasks: • Configure three interfaces on the PIX Firewall. • Configure four interfaces on the PIX Firewall.

© 2002, Cisco Systems, Inc.

7-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—7-2

Copyright  2002, Cisco Systems, Inc.

Configuring Additional Interfaces This section describes how to configure multiple interfaces on the Cisco Secure PIX Firewall.

Additional Interface Support • Supports up to eight additional interfaces e6

e0 e5 e4

e7 e3 e8

e2 e9

e1

• Increases the security of publicly available services • Easily interconnects multiple extranet or partner networks • Easily configured with standard PIX Firewall commands

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—7-4

The PIX Firewall supports up to eight additional perimeter interfaces for platform extensibility and security policy enforcement on publicly accessible services. The multiple perimeter interfaces enable the PIX Firewall to protect publicly accessible web, mail, and DNS servers on the Demilitarized zone (DMZ). Webbased and traditional Electronic Data Interchange (EDI) applications that link vendors and customers are also more secure and scalable when implemented using a physically separate network. As the trend toward building these extranet and partnernet applications accelerates, the PIX Firewall is already prepared to accommodate them.

Copyright  2002, Cisco Systems, Inc.

Configuring Multiple Interfaces

7-3

Access Through the PIX Firewall nat and global

Internet

e1 inside .1 security level 100 e0 outside .2 security level 0

PIX Firewall

static and conduit (or static and access list) © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—7-5

When configuring multiple interfaces, remember that the security level designates whether an interface is inside (trusted) or outside (untrusted) relative to another interface. An interface is considered inside in relation to another interface if its security level is higher than the other interface’s security level, and is considered outside in relation to another interface if its security level is lower than the other interface’s security level. The primary rule for security levels is that an interface with a higher security level can access an interface with a lower security level. The nat and global commands work together to enable your network to use any IP addressing scheme and to remain hidden from the external network. An interface with a lower security level cannot access an interface with a higher security level unless you specifically allow it by implementing static and conduit, or static and access list command pairs.

7-4

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Configure Three Interfaces pixfirewall(config)# pixfirewall(config)# nameif nameif ethernet0 ethernet0 outside outside sec0 sec0 pixfirewall(config)# pixfirewall(config)# nameif nameif ethernet1 ethernet1 inside inside sec100 sec100 pixfirewall(config)# pixfirewall(config)# nameif nameif ethernet2 ethernet2 dmz dmz sec50 sec50

Internet

192.168.0.0/24 e0 .2

e2

e1 .1 .1 10.0.0.0/24

.2

Bastion host

172.16.0.0/24

pixfirewall(config)# pixfirewall(config)# ip ip address address 192.168.0.2 192.168.0.2 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# ip ip address address 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# ip ip address address 255.255.255.0 255.255.255.0

outside outside inside inside 10.0.0.1 10.0.0.1 dmz dmz 172.16.0.1 172.16.0.1

pixfirewall(config)# pixfirewall(config)# nat nat (inside) (inside) 11 10.0.0.0 10.0.0.0 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# global global (outside) (outside) 11 192.168.0.20-192.168.0.254 192.168.0.20-192.168.0.254 netmask netmask 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# global global (dmz) (dmz) 11 172.16.0.20172.16.0.20172.16.0.254 172.16.0.254 netmask netmask 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# static static (dmz,outside) (dmz,outside) 192.168.0.11 192.168.0.11 172.16.0.2 172.16.0.2 pixfirewall(config)# pixfirewall(config)# conduit conduit permit permit tcp tcp host host 192.168.0.11 192.168.0.11 eq eq http http any any

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—7-6

A third interface is configured as shown in the previous figure. When your PIX Firewall is equipped with three or more interfaces, use the following guidelines to configure it while employing NAT: ■

The outside interface cannot be renamed or given a different security level.

■

An interface is always “outside” with respect to another interface that has a higher security level. Packets cannot flow between interfaces that have the same security level.

■

Use a single default route statement to the outside interface only. Set the default route with the route command.

■

Use the nat command to let users on the respective interfaces start outbound connections. Associate the nat_id with the global_id in the global command statement. The valid identification numbers can be any positive number up to two billion.

■

After you have completed a configuration in which you add, change, or remove a global statement, save the configuration and enter the clear xlate command so that the IP addresses will be updated in the translation table.

■

To permit access to servers on protected networks, use the static and conduit commands.

Copyright  2002, Cisco Systems, Inc.

Configuring Multiple Interfaces

7-5

Configure Four Interfaces Internet

192.168.0.0/24 e3 .1 172.18.0.0/24

Partnernet Partnernet 10.0.0.0/24

e0 .2 e1 .1

e2 .1

.2

Bastion host

172.16.0.0/24

DMZ DMZ

pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# pixfirewall(config)# pixfirewall(config)#

nameif nameif nameif nameif nameif nameif nameif nameif

ethernet0 ethernet0 ethernet1 ethernet1 ethernet2 ethernet2 ethernet3 ethernet3

outside outside sec0 sec0 inside inside sec100 sec100 dmz dmz sec50 sec50 partnernet partnernet sec40 sec40

pixfirewall(config)# pixfirewall(config)# 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# 255.255.255.0 255.255.255.0

ip ip address address outside outside 192.168.0.2 192.168.0.2 ip ip address address inside inside 10.0.0.1 10.0.0.1 ip ip address address dmz dmz 172.16.0.1 172.16.0.1 ip ip address address partnernet partnernet 172.18.0.1 172.18.0.1

pixfirewall(config)# pixfirewall(config)# nat nat (inside) (inside) 11 10.0.0.0 10.0.0.0 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# global global (outside) (outside) 11 192.168.0.20192.168.0.20192.168.0.254 192.168.0.254 netmask netmask 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# global global (dmz) (dmz) 11 172.16.0.20172.16.0.20172.16.0.254 172.16.0.254 netmask netmask 255.255.255.0 255.255.255.0 pixfirewall(config)# pixfirewall(config)# static static (dmz,outside) (dmz,outside) 192.168.0.11 192.168.0.11 172.16.0.2 172.16.0.2 pixfirewall(config)# pixfirewall(config)# conduit conduit permit permit tcp tcp host host 192.168.0.11 192.168.0.11 eq eq http http any any pixfirewall(config)# pixfirewall(config)# static static (dmz,partnernet) (dmz,partnernet) 172.18.0.11 172.18.0.11 172.16.0.2 172.16.0.2 pixfirewall(config)# pixfirewall(config)# conduit conduit permit permit tcp tcp host host 172.18.0.11 172.18.0.11 eq eq http http any any

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—7-7

In the figure above, the PIX Firewall has four interfaces. Users on all interfaces have access to all servers and hosts (inside, outside, DMZ, and partnernet). Configuring four interfaces requires more attention to detail but they are configured with standard PIX Firewall commands. To enable users on a higher security level interface to access hosts on a lower security interface, use the nat and global commands (for example, when users on the inside interface have access to the web server on the DMZ interface). To let users on a lower security level interface (users on the partnernet interface) access hosts on a higher security interface (DMZ), use the static and conduit commands. As seen in the figure above, the partnernet has a security level of 40 and the DMZ has a security level of 50. The DMZ will use nat and global commands to speak with the partnernet and will use statics and conduits to receive traffic from the partnernet.

7-6

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

The following table is a quick reference guide that explains when to use the nat and static commands for configuring varied interfaces in the PIX Firewall. From This Interface

To This Interface

Use This Command

Inside

Outside

nat

Inside

DMZ

nat

Inside

Partnernet

nat

DMZ

Outside

nat

DMZ

Partnernet

nat

DMZ

Inside

static

Partnernet

Outside

nat

Partnernet

DMZ

static

Partnernet

Inside

static

Outside

DMZ

static

Outside

Partnernet

static

Outside

Inside

static

Copyright  2002, Cisco Systems, Inc.

Configuring Multiple Interfaces

7-7

Summary This section summarizes the tasks you learned to complete in this chapter.

Summary • The PIX Firewall can be configured with up to ten interfaces. • Configuring multiple interfaces requires more attention to detail but can be done with standard PIX Firewall commands. • To enable users on a higher security level interface to access hosts on a lower security interface, use the nat and global commands. • To enable users on a lower security level interface to access hosts on a higher security interface, use the static and conduit commands. © 2002, Cisco Systems, Inc.

7-8

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—7-9

Copyright  2002, Cisco Systems, Inc.

Lab Exercise—Configure Inside Multiple Interfaces Complete the following lab exercise to practice what you learned in this chapter.

Objectives In this lab exercise you will complete the following tasks: ■

Configure inside multiple interfaces.

■

Configure outside access to the DMZ.

Visual Objectives The following figure displays the configuration you will complete in this lab exercise.

Lab Visual Objective Internet

Pod perimeter router

.1 192.168.P.0/24 e0 outside .2 172.16.P.0/24

PIX Firewall

.2

e2 dmz .1 e1 inside .1

Bastion host web and FTP server 10.0.P.0 /24 .3

172.26.26.50 Backbone server web, FTP, and TFTP server

© 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

Inside host web and FTP server

www.cisco.com

CSPFA 2.1—7-11

Configuring Multiple Interfaces Lab 7-1

Directions Your task in this exercise is to configure the PIX Firewall to work with a perimeter router to protect the campus network from intruders. One PIX Firewall is available for each pod group of two students. Work with your pod partners to perform the following steps in this lab exercise: ■

Task 1—Configure Inside Multiple Interfaces

■

Task 2—Configure Outside Access to the DMZ

Task 1—Configure Inside Multiple Interfaces Configure the PIX Firewall to allow access to the DMZ from the inside and outside network. Perform the following steps to configure the global address pools, NAT, and routing for the DMZ interface: Step 1

Assign one pool of IP addresses for hosts on the public DMZ. pixP(config)# global (dmz) 1 172.16.P.20-172.16.P.254 netmask 255.255.255.0

(where P = pod number) Step 2

Enable use of the name command to map text strings to IP addresses. pixP(config)# names

Step 3

Name the bastion host using the name command. The name configured here will be used in a later lab step. pixP(config)# name 172.16.P.2 bastionhost pixP(config)# show name

(where P = pod number) Step 4

Clear the translation table so that the global IP address will be updated in the table. pixP(config)# clear xlate

Step 5

Write the current configuration to Flash memory. pixP(config)# write memory

Step 6

Test connectivity to the bastion host from your internal host. C:\> ping 172.16.P.2

(where P = pod number) Step 7

Test Web access to your bastion host from the Windows NT server by doing the following sub-steps: 1. Open a web browser on the Windows NT server. 2. Use the web browser to access your bastion host by entering http://172.16.P.2. (where P = pod number) 3. The home page of the bastion host should appear on your web browser. 4. Use the show arp, show conn, and show xlate commands to observe the transaction:

Lab 7-2 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

pixP(config)# show arp outside 192.168.P.1 00e0.1e41.8762 inside 10.0.P.3 00e0.b05a.d509 dmz bastionhost 00e0.1eb1.78df

pixP(config)# show xlate Global 172.16.P.20 Local 10.0.P.3 static

pixP(config)# show conn 0 in use, 3 most used TCP out bastionhost:80 in 10.0.P.3:1074 idle 0:00:07 Bytes 380 flags UIO

Step 8

Test FTP access to the bastion host from your Windows NT server by completing the following sub-steps: 1. Establish an FTP session to the bastion host by choosing Start>Run>ftp 172.16.P.2. You have reached the bastion host if you receive the message “Connected to 172.16.P.2.” (where P = pod number) 2. Log into the FTP session. User (172.16.P.2(none)): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: cisco

3. Quit the FTP session if you were able to connect and log in: ftp> quit.

Task 2—Configure Outside Access to the DMZ Configure the PIX Firewall to permit outside access to hosts in the DMZ. Configure a static and conduit to test communications using ping between perimeter routers and the bastion host, and then configure HTTP and FTP access. Step 1

Create a static translation for your bastion host. Use the hostname configured in a previous lab step for the bastion host at 172.16.P.2. pixP(config)# static (dmz,outside) 192.168.P.11 bastionhost

(where P = pod number) Step 2

Ping a peer bastion host from your internal host as allowed by the conduit via the static. C:\> ping 192.168.Q.11

(where Q = peer pod number) Step 3

View current static translations. pixP(config)# show xlate Global 172.16.P.20 Local 10.0.P.3 Global 192.168.P.10 Local 10.0.P.3 static Global 192.168.P.11 Local bastionhost static

Step 4

Test web access to the bastion hosts of opposite pod groups by completing the following sub-steps 1. Open a web browser on the client PC.

Copyright  2002, Cisco Systems, Inc.

Configuring Multiple Interfaces Lab 7-3

2. Use the web browser to access the bastion host of your peer pod group by entering: http://192.168.Q.11. (where Q = peer pod number) 3. Have an opposite pod group attempt to access your bastion host in the same way. You should be unable to access the IP address of the static mapped to the bastion host of the opposite pod group. Step 5

Test FTP access to the bastion hosts of other pod groups by completing the following sub-steps: 1. On your FTP client, attempt to get into the bastion host of another pod group by choosing Start>Run>ftp 192.168.Q.11. You should be unable to access your peer’s bastion host via FTP. (where Q = peer pod number) 2. Have an opposite pod group use FTP to attempt to get into your bastion host.

Step 6

Configure conduits to allow Web and FTP access to the bastion host from the outside and then test the conduits. Configure the conduits to allow TCP traffic from clients on the outside network to access the DMZ bastion host using the previously configured static. pixP(config)# conduit permit tcp host 192.168.P.11 eq www any pixP(config)# conduit permit tcp host 192.168.P.11 eq ftp any

Step 7

Test Web access to the bastion hosts of opposite pod groups by completing the following sub-steps: 1. Open a web browser on the client PC. 2. Use the web browser to access the bastion host of your peer pod group: http://192.168.Q.11 (where Q = peer pod number) 3. Have an opposite pod group test your static and conduit configuration in the same way. 4. Use the show arp, show conn, and show xlate commands to observe the transaction.

Step 8

Test FTP access to the bastion hosts of other pod groups by completing the following sub-steps: 1. On your client PC, use FTP to get into the bastion host of another pod group by checking: Start>Run>ftp 192.168.Q.11. (where Q = peer pod number) 2. Have an opposite pod group use FTP to get into your bastion host to test your static and conduit configuration. 3. Use the show arp, show conn, and show xlate commands to observe the transaction.

Step 9

Write the current configuration to the terminal and verify that you have entered the previous commands correctly. Your configuration should appear similar to the following: pixP(config)# write terminal Building configuration...

Lab 7-4 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Building configuration... : Saved : PIX Version 5.3(1) nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security50 nameif ethernet3 intf3 security15 nameif ethernet4 intf4 security20 nameif ethernet5 intf5 security25 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pixP fixup protocol ftp 21 fixup protocol http 80 fixup protocol smtp 25 fixup protocol h323 1720 fixup protocol rsh 514 fixup protocol sqlnet 1521 fixup protocol sip 5060 names name 172.16.P.2 bastionhost pager lines 24 no logging timestamp no logging standby no logging console no logging monitor no logging buffered no logging trap logging facility 20 logging queue 512 interface ethernet0 100full interface ethernet1 100full interface ethernet2 100full interface ethernet3 auto shutdown interface ethernet4 auto shutdown interface ethernet5 auto shutdown mtu outside 1500 mtu inside 1500 mtu dmz 1500 mtu intf3 1500 mtu intf4 1500 mtu intf5 1500 ip address outside 192.168.P.2 255.255.255.0 ip address inside 10.0.P.1 255.255.255.0 ip address dmz 172.16.P.1 255.255.255.0 ip address intf3 127.0.0.1 255.255.255.255 ip address intf4 127.0.0.1 255.255.255.255 ip address intf5 127.0.0.1 255.255.255.255 ip audit info action alarm ip audit attack action alarm no failover failover timeout 0:00:00

Copyright  2002, Cisco Systems, Inc.

Configuring Multiple Interfaces Lab 7-5

failover poll 15 failover ip address outside 0.0.0.0 failover ip address inside 0.0.0.0 failover ip address dmz 0.0.0.0 failover ip address intf3 0.0.0.0 failover ip address intf4 0.0.0.0 failover ip address intf5 0.0.0.0 arp timeout 14400 global (outside) 1 192.168.P.20-192.168.P.254 netmask 255.255.255.0 global (dmz) 1 172.16.P.20-172.16.P.254 netmask 255.255.255.0 nat (inside) 1 10.0.P.0 255.255.255.0 0 0 static (inside,outside) 192.168.P.10 10.0.P.3 static (dmz,outside) 192.168.P.11 bastionhost conduit permit icmp any any conduit permit tcp host 192.168.P.10 eq www any conduit permit tcp host 192.168.P.11 eq www any conduit permit tcp host 192.168.P.11 eq ftp any route outside 0.0.0.0 0.0.0.0 192.168.P.1 1 timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si p 0:30:00 sip media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable no sysopt route dnat isakmp identity hostname telnet timeout 5 ssh timeout 5 terminal width 80 Cryptochecksum:9963c491006b1296815f3437947fab81 : end [OK]

Completion Criteria You have completed this exercise if you were able to reach your bastion host, and another group could reach your bastion host.

Lab 7-6 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

8

Dynamic Host Configuration Protocol Support

Overview This chapter includes the following topics: ■

Objectives

■

Dynamic Host Configuration Protocol

■

The PIX Firewall as a DHCP Server

■

The PIX Firewall as a DHCP Client

■

Summary

■

Lab Exercise

Objectives This section lists the chapter’s objectives.

Objectives

Upon completion of this chapter, you will be able to perform the following tasks: • Explain the function of the DHCP. • Explain the DHCP server and the DHCP client support in the PIX Firewall. • Configure the PIX Firewall as a DHCP server. • Configure the PIX Firewall as a DHCP client.

© 2002, Cisco Systems, Inc.

8-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—8-2

Copyright  2002, Cisco Systems, Inc.

Dynamic Host Configuration Protocol This section describes the function of the Dynamic Host Configuration Protocol (DHCP) and explains how the Cisco PIX Firewall can use it.

DHCP DHCP can be used to dynamically assign • An IP address and subnet mask. • The IP address of a DNS server. • The IP address of a Windows Internet Name Server (WINS). • A domain name. • A lease length.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-4

DHCP provides automatic allocation of reusable network addresses on a TCP/IP network. This provides ease of administration and dramatically reduces the margin of human error. Without DHCP, IP addresses must be manually entered at each computer or device that requires an IP address. DHCP can also distribute other configuration parameters such as DNS and Windows Internet Name Service (WINS) server addresses and domain names. The host that distributes the addresses and configuration parameters to DHCP clients is called a DHCP server. A DHCP Client is any host using DHCP to obtain configuration parameters. Since DHCP traffic consists of broadcasts and a significant goal of router configuration is to control unnecessary proliferation of broadcast packets, it may be necessary to enable forwarding of DHCP broadcast packets on routers that lie between your DHCP server and its clients. To have the Cisco IOS software forward these broadcasts, use the ip helper-address interface configuration command. The address specified in the command should be that of the DHCP server. Note

Copyright  2002, Cisco Systems, Inc.

WINS registers NetBIOS computer names and resolves them to IP addresses.

Dynamic Host Configuration Protocol Support

8-3

The PIX Firewall as the DHCP Server or Client

The PIX Firewall • Can distribute IP addresses, subnet masks, and other configuration parameters to DHCP clients on the internal network. • Can become a client to a DHCP server.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-5

Any PIX Firewall that runs version 5.2 or higher supports a DHCP server and client. A DHCP server is a device that provides configuration parameters to a DHCP client, and a DHCP client is a device that uses DHCP to obtain network configuration parameters. In a network environment secured by a PIX Firewall, PC clients connect to the PIX Firewall and establish network connections to access an enterprise or corporate network. As a DHCP server, the PIX Firewall provides these PCs (its DHCP clients) the networking parameters necessary for accessing the enterprise or corporate network, and once inside the network, the PIX Firewall provides the network services to use, such as the DNS server. As a DHCP client, the PIX Firewall is able to obtain an IP address, subnet mask, and, optionally, a default route from a DHCP server. Note

8-4

Currently, the PIX Firewall can distribute configuration parameters only to clients that are physically connected to the subnet of its inside interface.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

The PIX Firewall as a DHCP Server This section explains how to configure the PIX Firewall to act as a DHCP server.

DHCP Server Internet

1. DHCPDISCOVER—Client seeks an address

DHCP pool

2. DHCPOFFER—Server offers 10.0.0.3

10.0.0.3-10.0.0.20

3. DHCPREQUEST—Client requests 10.0.0.3 1

© 2002, Cisco Systems, Inc.

2

3

4

4. DHCPACK—Server acknowledges assignment of 10.0.0.3

www.cisco.com

CSPFA 2.1—8-7

DHCP communication consists of several broadcast messages passed between the DHCP client and DHCP server. The following events occur during this exchange: 1. The client broadcasts a DHCPDISCOVER message on its local physical subnet to locate available DHCP servers. 2. Any reachable DHCP server may respond with a DHCPOFFER message that includes an available network address and other configuration parameters. 3. Based on the configuration parameters offered in the DHCPOFFER messages, the client chooses one server from which to request configuration parameters. The client broadcasts a DHCPREQUEST message requesting the offered parameters from one server and implicitly declining offers from all others. 4. The server selected in the DHCPREQUEST message responds with a DHCPACK message containing the configuration parameters for the requesting client. If the selected server has since become unable to satisfy the DHCPREQUEST (for example, in case the requested network address has already been allocated) the server responds with a DHCPNAK message. The client receives either the DHCPNAK or the DHCPACK containing the configuration parameters. Note

Copyright  2002, Cisco Systems, Inc.

The PIX Firewall DHCP server does not support BOOTP requests and failover configurations.

Dynamic Host Configuration Protocol Support

8-5

Configuring the PIX Firewall as a DHCP Server • Assign a static IP address to the inside interface. • Specify a range of addresses for the DHCP server to distribute. • Specify the IP address of the DNS server (optional). • Specify the IP address of the WINS server (optional). • Specify the lease length (default = 3600 seconds). • Specify the ping timeout value (optional). • Configure the domain name (optional). • Enable DHCP. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-8

To enable DHCP server support on the PIX Firewall, complete the following steps:

8-6

Step 1

Assign a static IP address to the inside interface by using the ip address command.

Step 2

Specify a range of addresses for the DHCP server to distribute by using the dhcpd address command.

Step 3

Specify the IP address of the DNS server that the client will use by using the dhcpd dns command. This step is optional.

Step 4

Specify the IP address of the WINS server the client will use by using the dhcpd wins command. This step is also optional.

Step 5

Specify the lease length to grant the client by using the dhcpd lease command.

Step 6

Specify the ping timeout value using the dhcpd ping timeout command. This step is optional.

Step 7

Configure the domain name the client will use by using the dhcpd domain command. This step is optional.

Step 8

Enable the DHCP daemon within the PIX Firewall to listen for DHCP client requests on the enabled interface by using the dhcpd enable command.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

dhcpd address Command pixfirewall(config)#

dhcpd address ip1[-ip2] [if_name] • This command specifies a range of addresses for DHCP to assign.

pixfirewall(config)# dhcpd address 10.0.0.2–10.0.0.15 inside • The DHCP server assigns addresses 10.0.0.2–10.0.0.15 to DHCP clients on the inside. Addresses are assigned in numerical order starting with 10.0.0.2.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-9

The dhcpd address command specifies the range of IP addresses for the server to distribute. The address pool of a PIX Firewall DHCP server must be within the same subnet as the PIX Firewall interface that is enabled. In other words, the client must be physically connected to the subnet of a PIX Firewall interface. Up to 32 addresses can be included in the pool. The default for the PIX Firewall interface name is the inside interface, which is the only interface currently supported. The no dhcpd address command removes the DHCP server address pool. In the PIX Firewall versions 5.3 and above, the dhcpd ping timeout command is available. The DHCP server pings an address before issuing it to a client. If a response is received for the ping, the address is removed from the pool and is not assigned. The dhcpd ping_timeout command is used to specify how long the DHCP server will wait before allocating an address to a client. The syntax for the dhcpd address command is as follows: dhcpd address ip1[-ip2] [if_name] address ip1 [ip2]

The IP pool address range. The size of the pool is limited to 32 addresses.

if_name

Name of the PIX Firewall interface. The default is the inside interface. The PIX Firewall DHCP server daemon can only be enabled on the inside interface.

Copyright  2002, Cisco Systems, Inc.

Dynamic Host Configuration Protocol Support

8-7

dhcpd dns Command pixfirewall(config)#

dhcpd dns dns1 [dns2] • Specifies the IP address of the DNS server the client will use (optional)

pixfirewall(config)# dhcpd dns 10.0.0.20 • The DHCP server notifies the DHCP client that 10.0.0.20 is the address of the DNS server to use

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-10

The dhcpd dns command specifies the IP address of the DNS server for DHCP clients. Up to two DNS servers can be specified with this command. Use the no dhcpd dns command to remove the DNS IP addresses from your configuration. The syntax for the dhcpd dns command is as follows: dhcpd dns dns1 [dns2] dns dns1 [dns2]

8-8

Cisco Secure PIX Firewall Advanced 2.1

The IP addresses of the DNS servers for the DHCP client. The second server address is optional.

Copyright  2002, Cisco Systems, Inc.

dhcpd wins Command pixfirewall(config)#

dhcpd wins wins1 [wins2] • Specifies the IP address of the WINS server that the client will use (optional)

pixfirewall(config)# dhcpd wins 10.0.0.21 • The DHCP server notifies the DHCP client that it will use 10.0.0.21 as its WINS server

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-11

The dhcpd wins command can be used to specify up to two WINS servers for DHCP clients to use. This command is optional. The no dhcpd wins command removes the WINS server IP addresses from your configuration. The syntax for the dhcpd wins command is as follows: dhcpd wins wins1 [wins2] wins wins1 [wins2]

Copyright  2002, Cisco Systems, Inc.

The IP addresses of the Microsoft NetBios name servers (WINS servers). The second server address is optional.

Dynamic Host Configuration Protocol Support

8-9

dhcpd lease Command pixfirewall(config)#

dhcpd lease lease_length • Specifies the lease length to grant the client • Default = 3600 seconds

pixfirewall(config)# dhcpd lease 3600 • The DHCP clients can use their allocated leases for 3600 seconds

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-12

The dhcpd lease command specifies the amount of time in seconds, that the client can use the assigned IP address. The default is 3600 seconds. The minimum lease length is 300 seconds, and the maximum lease length is 2,147,483,647 seconds. The syntax of the dhcpd lease command is as follows: dhcpd lease lease_length lease lease_length

8-10

Cisco Secure PIX Firewall Advanced 2.1

The length of the lease in seconds granted to the DHCP client from the DHCP server. The lease indicates how long the client can use the assigned IP address. The default is 3,600 seconds. The minimum lease length is 300 seconds, and the maximum is 2,147,483,647 seconds.

Copyright  2002, Cisco Systems, Inc.

dhcpd ping_timeout Command pixfirewall(config)#

dhcpd ping_timeout timeout • Specifies the length of time the DHCP server waits before allocating an address to a client. • Default = 750 milliseconds

pixfirewall(config)# dhcpd ping_timeout 10000 • The DHCP server waits 10000 milliseconds (10 seconds) before allocating an address to a client.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-13

To avoid IP address conflicts, the DHCP server in the PIX Firewall pings an address before issuing it to a client. If a response to the ping is received, the PIX Firewall removes the address from its pool of DHCP addresses. In PIX Firewall software versions 5.3 and higher, the amount of time, in milliseconds, that the DHCP server waits for a response is configurable using the dhcpd ping_timeout command. The default value is 750 milliseconds. The minimum value is 100, and the maximum is 10000. The no dhcpd ping_timeout command can be used to reset the timeout value to the default. The syntax of the dhcpd ping_timeout command is as follows: dhcpd ping_timeout timeout ping_timeout timeout

Copyright  2002, Cisco Systems, Inc.

Specifies the amount of time the DHCP server waits before allocating an address to a client.

Dynamic Host Configuration Protocol Support

8-11

dhcpd domain Command pixfirewall(config)#

dhcpd domain domain_name • Specifies the domain name the client will use (optional)

pixfirewall(config)# dhcpd domain cisco.com • The DHCP server notifies the client that the domain name is cisco.com

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-14

You can configure the domain name the client will use with the dhcpd domain command. This is an optional step in configuring the PIX Firewall as a DHCP server. Use the no form of the command to remove a configured domain name. The syntax of the dhcpd domain command is as follows: dhcpd domain domain_name domain domain_name

8-12

Cisco Secure PIX Firewall Advanced 2.1

The DNS domain name (for example, example.com).

Copyright  2002, Cisco Systems, Inc.

dhcpd enable Command pixfirewall(config)#

dhcpd enable [if_name] • Enables the DHCP daemon within the PIX Firewall to listen for DHCP client requests on the enabled interface

pixfirewall(config)# dhcpd enable inside • The DHCP server feature is enabled on the inside interface

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-15

Enable the DHCP daemon within the PIX Firewall to listen for DHCP client requests on the enabled interface by executing the dhcpd enable command. Currently, you can only enable the DHCP server feature on the inside interface, which is the default. Use the no form of the command to disable the DHCP daemon. The syntax of the dhcpd enable command is as follows: dhcpd enable [if_name] if_name

Copyright  2002, Cisco Systems, Inc.

Name of the PIX Firewall interface. The default is the inside interface. The DHCP server daemon can only be enabled on the inside interface.

Dynamic Host Configuration Protocol Support

8-13

debug dhcpd and clear dhcpd Commands pixfirewall(config)#

debug dhcpd event | packet • Displays information associated with the DHCP server pixfirewall(config)#

clear dhcpd • Removes all dhcpd command statements from the configuration

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-16

The debug dhcpd command displays information associated with the DHCP server. Use the debug dhcpd event command to display event information about the DHCP server, and use the debug dhcpd packet command to display packet information about the DHCP server. Use the no form of the debug dhcpd command to disable debugging. The syntax of the debug dhcpd command is as follows: debug dhcpd event | packet dhcpd event

Displays event information associated with the DHCP server.

dhcpd packet

Displays packet information associated with the DHCP server.

The clear dhcpd command can be used to clear all dhcpd commands, and binding and statistics information. Use the clear dhcpd command with no options to remove all dhcpd command statements from the configuration. The syntax of the clear dhcpd command is as follows: clear dhcpd [binding | statistics]

8-14

bindings

The binding information for a given server IP address and its associated client hardware address and lease length.

statistics

Statistical information, such as address pool, number of bindings, malformed messages, sent messages, and received messages.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

The PIX Firewall as a DHCP Client This section explains how to configure your PIX Firewall as a DHCP client.

ip address dhcp Command pixfirewall(config)#

ip address if_name dhcp [setroute] • This command enables the DHCP client feature on the specified PIX Firewall interface.

pixfirewall(config)# ip address outside dhcp setroute • The DHCP client feature is enabled on the outside interface. Because the optional setroute argument is used, the PIX Firewall sets the default route using the default gateway address returned by the DHCP server. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-18

Use the ip address dhcp command to enable the DHCP client feature on the PIX Firewall. DHCP client support within the PIX Firewall is designed for use within small office or home office environments using a PIX Firewall that is directly connected to a DSL or cable modem that supports the DHCP server function. The outside PIX Firewall interface can acquire its address and subnet mask (and optionally, a default route) from a DHCP server. This address can then be used as the PAT global address. This makes it unnecessary for the ISP to assign a static IP address to the PIX Firewall unit. In software versions 6.0 and higher, the ip address command has been enhanced to enable you to enter the number of times the PIX Firewall polls for DHCP information. Use the ip address outside dhcp command to enable the PIX Firewall to retry a poll for DHCP information. The syntax of the ip address dhcp commands are as follow: ip address if_name dhcp [setroute] ip address outside dhcp [setroute] [retry retry_cnt] if_name

The internal or external interface name designated by the nameif command.

dhcp

Enables the DHCP client feature on the specified interface.

setroute

This option tells the PIX Firewall to set the default route using the default gateway parameter the DHCP server returns.

Copyright  2002, Cisco Systems, Inc.

Dynamic Host Configuration Protocol Support

8-15

8-16

outside

Interface from which the PIX Firewall polls for information.

retry

Enables the PIX Firewall to retry a poll for DHCP information.

retry_cnt

Specifies the number of times a PIX Firewall polls for DHCP information. The values available are 4 to 16. If no value is specified, the default is 4.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

debug dhcpc Commands pixfirewall(config)#

debug dhcpc packet • Displays packet information associated with the DHCP client

pixfirewall(config)# debug dhcpc packet pixfirewall(config)#

debug dhcpc detail • Displays detailed information about the DHCP client packets

pixfirewall(config)# debug dhcpc detail pixfirewall(config)#

debug dhcpc error • Displays error messages associated with the DHCP client

pixfirewall(config)# debug dhcpc error © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-19

The debug dhcpc packet, debug dhcpc detail, and debug dhcpc error commands display information associated with the DHCP lease. Use the no form of these commands to disable debugging. The syntax of the debug dhcpc command is as follows: debug dhcpc detail | error | packet dhcpc detail

Displays detailed information about the DHCP client packets.

dhcpc error

Displays error messages associated with the DHCP client.

dhcpc packet

Displays packet information associated with the DHCP client.

Copyright  2002, Cisco Systems, Inc.

Dynamic Host Configuration Protocol Support

8-17

dhcpd auto_config Command pixfirewall(config)#

dhcpd auto_config[client_ifx_name] • Enables the PIX Firewall to automatically configure DNS, WINS, and domain name values from the DHCP client to the DHCP server.

pixfirewall(config)# ip address outside dhcp pixfirewall(config)# dhcpd address 10.0.0.51-10.0.0.60 inside pixfirewall(config)# dhcpd enable inside pixfirewall(config)# dhcpd auto_config • The PIX Firewall obtains its outside IP address and other configuration parameters from a DHCP server on its outside interface. • The PIX Firewall distributes IP addresses from the 10.0.0.51-10.0.0.60 range to its own DHCP clients, the hosts on its inside interface. • The PIX Firewall passes other configuration parameters it obtained from the DHCP server on its outside interface to the hosts on its inside interface. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-20

The PIX Firewall can be a DHCP server, a DHCP client, or a DHCP server and client simultaneously. DHCP server and client support enables you to automatically leverage the DNS, WINS, and domain name values obtained by the PIX Firewall DHCP client for use by the hosts served by the PIX Firewall’s DHCP server. Use the dhcpd auto_config command to enable the PIX Firewall to automatically pass configuration parameters it receives from a DHCP server to its own DHCP clients. DHCP must be enabled with the dhcpd enable command in order to use the dhcpd auto_config command. To disable the auto_config feature, use the no dhcpd auto_config command. The syntax of the dhcp auto_config command is as follows: dhcpd auto_config [client_ifx_name] no dhcpd auto_config [client_ifx_name]

8-18

auto_config

Enables the PIX Firewall to automatically configure DNS, WINS, and domain name values from the DHCP client to the DHCP server.

client_ifx_name

Supports only the outside interface at this time. When more interfaces are supported, this argument will specify which interface supports the DHCP auto_config feature.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Summary This section summarizes the information you learned in this chapter.

Summary

• DHCP can be used to assign IP addresses, subnet masks, and other configuration parameters. • The PIX Firewall can become a DHCP server or a DHCP client. • Use the dhcpd address, dhcpd lease, and dhcpd enable commands to configure the PIX Firewall as a DHCP server. • Use the ip address dhcp command to configure the PIX Firewall as a DHCP client.

© 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-22

Dynamic Host Configuration Protocol Support

8-19

8-20

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Lab Exercise—Configure the PIX Firewall’s DHCP Server and Client Features Complete the following lab exercise to practice what you learned in this chapter. This lab exercise is divided into two sections: Configure the PIX Firewall’s DHCP Server Feature and Configure the PIX Firewall’s DHCP Client Feature

Configure the PIX Firewall’s DHCP Server Feature Complete the following section to practice what you learned in this chapter.

Objectives In this lab exercise, you will complete the following tasks: ■

Verify the PIX Firewall’s inside IP address.

■

Configure the PIX Firewall’s DHCP server Feature.

■

Test the PIX Firewall’s DHCP server feature.

■

Disable the DHCP on the NT server.

■

Disable the PIX Firewall’s DHCP server feature.

Visual Objective

Lab Visual Objective 172.26.26.0/24

Internet .2

.50 Backbone server web, FTP, and TFTP server 192.168.P.0/24

.1 .2

172.16.P.0/24

.2

DHCP server Bastion host web and FTP server

10.0.P.0/24

DHCP pool 10.0.P.51-10.0.P.60

© 2002, Cisco Systems, Inc.

Copyright  2002, Cisco Systems, Inc.

.51 DHCP client

www.cisco.com

CSPFA 2.1—8-24

Dynamic Host Configuration Protocol Support Lab 8-1

Task 1—Verify the PIX Firewall’s Inside IP Address Complete the following steps to verify the PIX Firewall’s inside IP address: Step 1

Display the currently configured IP addresses: pixP(config)# show ip address

Step 2

Ensure that the IP address on the inside interface is 10.0.P.1. (where P = pod number)

Step 3

Establish a connection to the web server at 172.26.26.50 by completing the following sub-steps: 1. Open a web browser on your Windows NT server. 2. Use the web browser to access the web server by entering : http://172.26.26.50

Task 2—Configure the PIX Firewall’s DHCP Server Feature Complete the following steps to configure the PIX Firewall’s DHCP Server feature: Step 1

Specify a range of addresses for the DHCP server to distribute: pixP (config)# dhcpd address 10.0.P.51-10.0.P.60 inside

(where P = pod number) Step 2

Specify the IP address of the DNS server the client will use: pixP (config)# dhcpd dns 10.0.P.75

(where P = pod number) Step 3

Specify the IP address of the WINS server the client will use: pixP (config)# dhcpd wins 10.0.P.76

(where P = pod number) Step 4

Specify the lease length to grant the client: pixP (config)# dhcpd lease 3000

Step 5

Configure the domain name the client will use: pixP (config)# dhcpd domain cisco.com

Step 6

Enable the DHCP daemon within the PIX Firewall to listen for DHCP client requests on the enabled interface: pixP (config)# dhcpd enable inside

Step 7

Display the DHCP configuration and binding: pixP (config)# show dhcpd dhcpd address 10.0.P.51-10.0.P.60 inside dhcpd dns 10.0.P.75 dhcpd wins 10.0.P.76 dhcpd lease 3000 dhcpd ping_timeout 750 dhcpd domain cisco.com dhcpd enable inside

Lab 8-2 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Step 8

Save your DHCP configuration: pixP (config)# write memory

Task 3—Test the PIX Firewall’s DHCP Server Feature Complete the following steps to test the PIX Firewall’s DHCP server feature: Step 1

Right-click the My Network Places desktop icon and choose Properties. The Network and Dial-up Connections window opens.

Step 2

Double-click the Local Area Connection icon. The Local Area Connection Status window opens.

Step 3

Click Properties. The Local Area Connection Properties window opens.

Step 4

Select the Internet Protocol (TCP/IP) component and click Properties. The Internet Protocol (TCP/IP) Properties window opens.

Step 5

Select the Obtain an IP address automatically option.

Step 6

Click OK to close the Internet Protocol (TCP/IP) Properties window.

Step 7

Click OK to close the Local Area Connection Properties window. It may take a few moments for the window to close.

Step 8

Close the Local Area Connection Status window.

Step 9

Close the Network and Dial-up Connections window.

Step 10

Open a Windows NT command prompt, and release and renew your IP address: C:\> ipconfig /release C:\> ipconfig /renew

Step 11 Verify that the PIX Firewall assigned an IP address, subnet mask, DNS address,

WINS address, and domain name to your NT server by opening a Windows NT command prompt and viewing the IP configuration: C:\> ipconfig /all

Step 12 Establish a connection to the web server at 172.26.26.50:

1. Open a web browser on your Windows NT Server. 2. Use the web browser to access the web server by entering: http://172.26.26.50.

Task 4—Disable the DHCP on the NT Server Complete the following steps to display DHCP on the NT Server: Step 1

Right-click the My Network Places icon on your Windows NT desktop and choose Properties. The Network and Dial-up Connections window opens.

Step 2

Double-click the Local Area Connection icon. The Local Area Connection Status window opens.

Step 3

Click Properties. The Local Area Connection Properties window opens.

Step 4

Select the Internet Protocol (TCP/IP) component and click Properties. The Internet Protocol (TCP/IP) Properties window opens.

Step 5

Select the Specify an IP address option.

Copyright  2002, Cisco Systems, Inc.

Dynamic Host Configuration Protocol Support Lab 8-3

Step 6

Enter 10.0.P.3 in the IP Address text box. (where P = pod number)

Step 7

Enter 255.255.255.0 in the Subnet Mask text box.

Step 8

Enter 10.0.P.1 in the Default Gateway text box. (where P = pod number)

Step 9

Click the Advanced button. The Advanced TCP/IP Settings window opens.

Step 10 Click Add within the IP Addresses group box. Step 11 In the TCP/IP Address box, enter 10.1.P.3 as the IP address and 255.255.255.0 as

the Subnet Mask. (where P = pod number) Step 12 Click Add. Step 13 Click OK to close the Advanced TCP/IP Settings window. Step 14 Click OK to close the Internet Protocol (TCP/IP) Properties window. Step 15 Click OK to close the Local Area Connection Properties window. It may take a

few moments for the window to close. Step 16 Close the Local Area Connection Status window. Step 17 Close the Network and Dial-up Connections window. Step 18 Restart the computer. Step 19 Log back into your computer. Step 20 At a Windows NT command prompt, verify that the configuration supplied by the

PIX Firewall’s DHCP server has been removed, and that the following IP configuration exists on your Windows NT computer: C:\> ipconfig /all ■

Hostname—NTP

■

DNS Server—(blank)

■

DHCP Enabled—no

■

IP Address—10.1.P.3 (where P = pod number)

■

Subnet Mask—255.255.255.0

■

IP Address—10.0.P.3 (where P = pod number)

■

Subnet Mask—255.255.255.0

■

Default Gateway—10.0.P.1 (where P = pod number)

Lab 8-4 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Task 5—Disable the PIX Firewall’s DHCP Server Feature Complete the following steps to disable PIX Firewall’s DHCP server feature: Step 1

From a Windows NT command prompt, telnet to the backbone router. C:\> telnet 10.0.P.100

(where P = pod number) Step 2

When prompted for a password, enter cisco.

Step 3

Connect to your PIX Firewall: rbb> pPp

(where P = pod number) Step 4

Clear all dhcpd commands, binding, and statistics information: pixP (config)# clear dhcpd

Step 5

Verify that the DHCP feature has been disabled: pixP (config)# show dhcpd

Step 6

Save your current configuration: pixP(config)# write memory

Copyright  2002, Cisco Systems, Inc.

Dynamic Host Configuration Protocol Support Lab 8-5

Configure the PIX Firewall’s DHCP Client Feature Complete the following section to configure the PIX Firewall’s DHCP client feature.

Objectives In this lab exercise, you will complete the following tasks: ■

Configure the PIX Firewall to use its outside interface address for PAT.

■

Configure your router to pass DHCP broadcasts.

■

Configure the PIX Firewall’s DHCP client feature.

■

Test the DHCP client and PAT.

■

Remove the DHCP client configuration.

Visual Objectives

Lab Visual Objective 172.26.26.0/24

Internet

DHCP pool 192.168.P.75-192.168.P.99

.2

.50 Backbone server DHCP, web, FTP, and TFTP server 192.168.P.0/24

.1 .75

DHCP client

172.16.P.0/24

.2 Bastion host web and FTP server

10.0.P.0/24 .3

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—8-25

Setup Before starting this lab exercise, access the PIX Firewall console using Telnet.

Lab 8-6 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Task 1—Configure the PIX Firewall to Use its Outside Interface Address for PAT Complete the following steps to configure the PIX Firewall to use its outside interface address for PAT: Step 1

Remove the following currently configured global pool and static mapping. pixP(config)# no global (outside) 1 192.168.P.20-192.168.P.254 pixP(config)# no static (inside,outside) 192.168.P.10 10.0.P.3

(where P = pod number) Step 2

Configure PAT to use the outside interface address: pixP(config)# global (outside) 1 interface

(where P = pod number)

Task 2—Configure Your Router to Pass DHCP Broadcasts Complete the following steps to configure your router to pass DHCP broadcast: Step 1

From a Windows NT command prompt, telnet to the backbone router: C:\> telnet 10.0.P.100

(where P = pod number) Step 2

When prompted for a password, enter cisco.

Step 3

Connect to your perimeter router: rbb> rP

(where P = pod number) Step 4

Enter privileged mode: rP> enable

Step 5

When prompted for a password, enter cisco.

Step 6

Enter global configuration mode: rP# configure terminal

Step 7

Access the inside interface: rP(config)# interface e0/0

Step 8

Configure the router to pass DHCP broadcast traffic. Because the backbone server is the DHCP server, use its address,172.26.26.50, as the IP helper address. rP(config-if)# ip helper-address 172.26.26.50

Step 9

Exit configuration mode by pressing Ctrl+Z.

Step 10 Save your configuration: rP# write memory

Copyright  2002, Cisco Systems, Inc.

Dynamic Host Configuration Protocol Support Lab 8-7

Task 3—Configure the PIX Firewall’s DHCP Client Feature Complete the following steps to configure the PIX Firewall’s DHCP client feature: Step 1

Connect again to your PIX Firewall, enter configuration mode, and remove the currently configured IP addresses: pixP (config)# clear ip address

Step 2

Configure the inside IP address: pixP(config)# ip address inside 10.0.P.1 255.255.255.0

(where P = pod number) Step 3

Configure the PIX Firewall to retrieve its outside IP address from a DHCP server: pixP (config)# ip address outside dhcp

Step 4

Notice the IP address assigned to the PIX Firewall.

Task 4—Test the DHCP Client and PAT Complete the following steps to test the DHCP client and PAT: Step 1

Clear the translation table: pixP(config)# clear xlate

Step 2

Assure that the translation table is clear: pixP(config)# show xlate

Step 3

Test the use of the DHCP-retrieved address for PAT: 1. Open a web browser on your Windows NT Server. 2. Use the web browser to access the backbone server: by entering http://172.26.26.50.

Step 4

View the translation table to see the address used for PAT: pixP(config)# show xlate

Task 5—Remove the DHCP Client Configuration Complete the following remove the DHCP client configuration: Step 1

Disable the DHCP client feature. pixP(config)# no ip address outside dhcp

Step 2

Remove the dynamically assigned IP address: pixP(config)# clear ip address

Step 3

Assign static addresses to the inside, outside, and DMZ interfaces: pixP(config)# ip address outside 192.168.P.2 255.255.255.0 pixP(config)# ip address inside 10.0.P.1 255.255.255.0 pixP(config)# ip address dmz 172.16.P.1 255.255.255.0

(where P = pod number)

Lab 8-8 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Step 4

Verify that the static addresses are in place and that the interfaces are up: pixP(config)# show interface

Step 5

Remove the global command that uses the interface option: pixP(config)# no global (outside) 1 interface

Step 6

Reinstate the global pool and static mapping you removed earlier. pixP(config)# global (outside) 1 192.168.P.20-192.168.P.254 netmask 255.255.255.0 pixP(config)# static (inside,outside) 192.168.P.10 10.0.P.3

(where P = pod number) Step 7

Save your configuration. pixP(config)# write memory

Copyright  2002, Cisco Systems, Inc.

Dynamic Host Configuration Protocol Support Lab 8-9

Lab 8-10 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

9

Configuring Syslog

Overview This chapter includes the following topics: ■

Objectives

■

Syslog messages

■

Summary

■

Lab exercise

Objectives This section lists the chapter’s objectives.

Objectives Upon completion of this chapter, you will be able to perform the following tasks: • Configure Syslog message output to the PIX Firewall buffer. • Configure the PIX Firewall to forward Syslog messages to a Syslog server.

© 2002, Cisco Systems, Inc.

9-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—9-2

Copyright  2002, Cisco Systems, Inc.

Syslog Messages This section explains Syslog message output from a Cisco PIX Firewall to a Syslog server or host.

Configure Syslog Output to a Syslog Server Pod perimeter router .1 192.168.0.0/24 e0 outside .2 172.16.0.0/24

PIX Firewall

.2

e2 dmz .1 e1 inside .1

Bastion host web and FTP server 10.0.0.0 /24 .3

Inside host Syslog server © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—9-4

The PIX Firewall generates Syslog messages for system events, such as alerts and resource depletion. Syslog messages may be used to create e-mail alerts and log files, or displayed on the console of a designated Syslog host. If you do not already have a Syslog server at your place of business, you can download a copy of the software from the Cisco Connection Online web site. The PIX Firewall can send Syslog messages to any Syslog server. In the event that all Syslog servers or hosts are offline, the PIX Firewall stores up to 100 messages in its memory. Subsequent messages that arrive overwrite the buffer starting from the first line.

Copyright  2002, Cisco Systems, Inc.

Configuring Syslog

9-3

Syslog Messages The PIX Firewall sends Syslog messages to document the following events: • Security • Resources • System • Accounting

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—9-5

The PIX Firewall sends Syslog messages to document the following events:

9-4

■

Security—Dropped UDP packets and denied TCP connections

■

Resources—Notification of connection and translation slot depletion

■

System—Console and Telnet logins and logouts, and when the PIX Firewall reboots

■

Accounting—Bytes transferred per connection

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Configure Message Output to the PIX Firewall Buffer pixfirewall(config)#

logging buffered level • Step 1—Send Syslog messages to an internal buffer. pixfirewall(config)#

show logging • Step 2—View messages in the internal buffer. pixfirewall(config)#

clear logging • Step 3—Clear the internal buffer. pixfirewall(config)#

[no] logging message syslog_id • Enable or disable specific Syslog message type logging. pixfirewall(config)#

logging standby • Allow a standby unit to send Syslog messages. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—9-6

Use the logging buffered command to specify what Syslog messages appear on the PIX Firewall console as each message occurs: logging buffered level. You can limit the types of messages that appear on the console with level. Note

Cisco recommends that you do not use this command in production mode because its use degrades PIX Firewall performance.

Use the show logging command to list the current message buffer. Use the clear logging command to clear the message buffer. New messages append to the end of the buffer. Use the logging message command to specify a message to be allowed. Use with the no command to suppress a message. All Syslog messages are permitted unless explicitly disallowed. The “PIX Startup begin” message cannot be blocked and neither can more than one message per command statement. Specify a message number to disallow or allow. If a message is listed in the Syslog as %PIX-1101001, use “101001” as the syslog_id. Refer to the System Log Messages for the Cisco Secure PIX Firewall Version 5.1 guide for message numbers. PIX Firewall documentation is available online: www.cisco.com/univercd/cc/td/doc/product/iaabu/pix Use the logging standby command to allow a failover standby PIX Firewall unit to send Syslog messages. This option is disabled by default. Enabling it ensures that the Standby PIX Firewall’s Syslog messages stay synchronized if failover occurs; however, it doubles the amount of traffic on the Syslog server. You can disable this feature with the no logging standby command.

Copyright  2002, Cisco Systems, Inc.

Configuring Syslog

9-5

The following table shows the commands used in configuring a Syslog server.

9-6

Buffered

Sends Syslog messages to an internal buffer that can be viewed with the show logging command.

Show

Lists which logging options are enabled. If the logging buffered command is in use, the show logging command lists the current message buffer.

Clear

Clears the buffer for use with the logging buffered command.

Message

Specifies a message to be allowed. Use with the no command to suppress a message. Use the clear logging disabled command to reset the disallowed messages to the original set. Use the show message disabled command to list the suppressed messages you specified with the no logging message command. All Syslog messages are permitted unless explicitly disallowed. The “PIX Startup begin" message cannot be blocked and neither can more than one message per command statement.

Syslog_id

Specifies a message number to disallow or allow. If a message is listed in Syslog as %PIX-1-101001, use "101001" as the syslog_id. Refer to the System Log Messages for the Cisco Secure PIX Firewall Version 5.1 guide for message numbers. PIX Firewall documentation is available online: www.cisco.com/univercd/cc/td/doc/product/iaabu/pix

Standby

Allows the failover standby PIX Firewall to send Syslog messages. This option is disabled by default. You can enable it to ensure that the Standby PIX Firewall’s Syslog messages stay synchronized if failover occurs. However, this option causes twice as much traffic on the Syslog server. This feature can be disabled with the no logging standby command.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Configure Message Output to a Syslog Server pixfirewall(config)#

logging host [in_if_name] ip_address [protocol/port] • Step 1—Designate the Syslog host server. pixfirewall(config)#

logging trap level • Step 2—Set the logging level.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—9-7

To send messages to a Syslog server, complete the following: Step 1

Designate a host to receive the messages with the logging host command: logging host [in_if_name] ip_address [protocol / port]

Replace in_if_name with the interface on which the server exists and ip_address with the IP address of the host. If the Syslog server is receiving messages on a non-standard port, you can replace a protocol with a UDP, and port with the new port value. The default protocol is UDP with a default port of 514, and the allowable range for changing the value is 1025 through 65535. You can also specify TCP with a default of 1470, and the allowable range is 1025 through 65535.

Step 2

Note

Multiple logging host commands are allowed for the PIX Firewall to send Syslog messages to multiple servers, but only one protocol, UDP or TCP, is permitted for a specific Syslog server. A subsequent command statement overrides the previous one.

Note

The PIX Firewall sends only TCP Syslog messages to the PIX Firewall Syslog Server.

Specify the logging levels that will be forwarded to the Syslog server with the logging trap command: logging trap level

Copyright  2002, Cisco Systems, Inc.

Configuring Syslog

9-7

Configure Message Output to a Syslog Server (cont.) pixfirewall(config)#

logging facility facility • Step 3—Set the facility marked on all messages. pixfirewall(config)#

[no] logging timestamp • Step 4—Start and stop sending timestamp messages. pixfirewall(config)#

[no] logging on • Step 5—Start or stop sending messages to the Syslog server. www.cisco.com

© 2002, Cisco Systems, Inc.

Step 3

CSPFA 2.1—9-8

Specify the logging facility to which the PIX Firewall will assign the Syslog messages with the logging facility command: logging facility facility

Because network devices share the eight facilities, logging facility enables you to set the facility marked on all messages. Step 4

If you want to send time-stamped messages to a Syslog server, use the logging timestamp command to enable time stamping. To disable time-stamp logging, use the no logging timestamp command.

Step 5

Start sending messages with the logging on command. To disable sending messages use the no logging on command. The following table shows the commands used in configuring a Syslog server. host

Specifies a Syslog server that will receive the messages sent from the PIX Firewall. You can use multiple logging host commands to specify additional servers that would all receive messages.

trap

Traps less than or equal the level for the logging host. Also enables sending SNMP messages at less than or equal to the level you specify.

level

Specifies the Syslog message level as a number or string. The level you specify means that you want to use that level and those less than the level. Possible number and string level values follow: 0−emergencies—System unusable messages 1−alerts—Take immediate action 2−critical—Critical condition 3−errors—Error message 4−warnings—Warning message 5−notifications—Normal but significant condition 6−informational—Information message 7−debugging—Debug messages and log FTP commands and WWW URLs

9-8

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

facility

Specifies the Syslog facility. The default is 20.

facility

There are eight facilities: LOCAL0(16) through LOCAL7(23). The default is LOCAL4(20). Hosts file the messages based on the facility number in the message.

timestamp

Specifies that Syslog messages sent to the Syslog server should have a time stamp value on each message.

on

Start sending Syslog messages to all output locations. Stop all logging with the no logging on command.

in_if_name

Interface on which the Syslog server resides.

ip_address

Syslog server’s IP address.

Copyright  2002, Cisco Systems, Inc.

Configuring Syslog

9-9

Summary This section summarizes what you have learned in this chapter.

Summary

• The PIX Firewall can generate Syslog messages for system events. • Syslog messages can be sent to the PIX Firewall buffer. • The PIX Firewall can forward Syslog messages to any Syslog server.

© 2002, Cisco Systems, Inc.

9-10

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—9-10

Copyright  2002, Cisco Systems, Inc.

Lab Exercise—Configure Syslog Output to a Syslog Host or Server from the PIX Firewall Complete the following lab to practice what you learned in this chapter.

Objectives In this lab exercise you will complete the following tasks: ■

Configure Syslog output.

■

Configure Syslog output to a Syslog server.

Visual Objective The following illustration displays the configuration you will complete in this lab exercise.

Lab Visual Objective Internet

Pod perimeter router .1 192.168.P.0/24 e0 outside .2 172.16.P.0/24

PIX Firewall

.2

e2 dmz .1 e1 inside .1

Bastion host, web, and FTP server 10.0.P.0 /24 .3

172.26.26.50

Backbone server, web, FTP, and TFTP server © 2002, Cisco Systems, Inc.

Inside host Syslog server www.cisco.com

CSPFA 2.1—9-12

Setup Before starting this lab exercise, set up your equipment as follows: ■

Copyright  2002, Cisco Systems, Inc.

Verify that the PIX Firewall is turned on and that your PC is connected to the PIX Firewall.

Configuring Syslog Lab 9-1

■

Verify that you have a floppy diskette created from the following files: your version and rawrite.exe.

Directions In this lab exercise you will configure the PIX Firewall to send Syslog messages to a Syslog server or host. Work with your lab partner to perform the following steps in this lab exercise: ■

Task 1—Configure Syslog Output

■

Task 2—Configure Syslog Output to a Syslog Server

Task 1—Configure Syslog Output Perform the following steps and enter the commands as directed to configure Syslog output: Step 1

Enable Syslog logging. pixP(config)# logging on

Step 2

Begin storing messages to the PIX Firewall message buffer and set the logging level to debugging. pixP(config)# logging buffered debugging

Step 3

Clear the translate table, and then open a new Telnet window. Go to the perimeter router and ping your inside host. pixP(config)# clear xlate rP> ping 192.168.P.10

(where P = pod number) Step 4

View the Syslog messages with the show logging command. New messages appear at the end of the display. pixP(config)# show logging Syslog logging: enabled Timestamp logging: disabled Standby logging: disabled Console logging: disabled Monitor logging: disabled Buffer logging: level debugging, 10 messages logged Trap logging: disabled History logging: disabled 305002: Translation built for gaddr 192.168.P.10 to laddr 10.0.P.3

Step 5

Clear messages in the buffer and verify they are cleared. pixP(config)# clear logging pixP(config)# show logging

Step 6

Set the logging buffered command back to a minimal level. pixP(config)# logging buffered alerts

Lab 9-2 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Task 2—Configure Syslog Output to a Syslog Server The instructor will provide you with the procedures for access to a Syslog server or host. This varies according to the type of Syslog server used for your classroom environment. Note

Step 1

Check to verify that the Syslog server or host is turned on and that the Syslog service is installed and started.

Designate a host to receive the messages with the logging host command. For normal Syslog operations to any Syslog server, use the default message protocol,. pixP(config)# logging host inside 10.0.P.3

(where P = pod number) Step 2

Set the logging level to the Syslog server or host with the logging trap command. This command is used to start sending messages to the Syslog server or host. For level, refer back to the command reference table at the beginning of this exercise. pixP(config)# logging trap debugging

Step 3

Start sending messages. pixP(config)# logging on

Step 4

From your Windows command line, telnet to your perimeter router. C:\> telnet 192.168.P.1

(where P = pod number) Step 5

Go to the Syslog server or host, and locate the file that contains the Syslog messages sent by the PIX Firewall Syslog. Your instructor will inform you of file locations, as this varies according to your lab environment. <166>%PIX-6-302010: 0 in use, 1 most used <166>%PIX-6-302001: Built outbound TCP connection for faddr 192.168.P.1/23 gaddr 192.168.P.10/3104 laddr 10.0.P.3/3104

Copyright  2002, Cisco Systems, Inc.

Configuring Syslog Lab 9-3

Lab 9-4 Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

10

Access Control Configuration and Content Filtering

Overview This chapter includes the following topics: ■

Objectives

■

Access control lists

■

Converting conduits to access control lists

■

Configuring access control

■

Malicious active code filtering

■

URL filtering

■

Summary

■

Lab exercise

Objectives This section lists the chapter’s objectives.

Objectives Upon completion of this chapter, you will be able to perform the following tasks: • Understand and configure ACLs. • Convert conduits to ACLs. • Understand remote configuration using SSH. • Configure active code filtering (ActiveX and Java applets). • Configure the PIX Firewall for URL filtering. © 2002, Cisco Systems, Inc.

10-2

Cisco Secure PIX Firewall Advanced 2.1

www.cisco.com

CSPFA 2.1—10-2

Copyright  2002, Cisco Systems, Inc.

Access Control Lists This section discusses access control through the Cisco Secure PIX Firewall using an access control list (ACL).

Access Control List • An ACL enables you to determine what traffic will be allowed or denied through the PIX Firewall. • ACLs are applied per interface (traffic is analyzed inbound relative to an interface). • The access-list and access-group commands are used to create an ACL. • The access-list and access-group commands are an alternative for the conduit and outbound commands.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-4

An ACL is a list kept by routers and the PIX Firewall to control access to and from the router or firewall (for example, to prevent packets with a certain IP address from leaving a particular interface). An ACL is implemented using two commands: the access-list command and the access-group command. Use the access-list command to create an ACL. The access-group command binds the ACL to a specific interface on the router or PIX Firewall. Only one ACL can be bound to an interface using the access-group command. The access-list and access-group commands are an alternative to the outbound command statement. The access-list and access-group commands also take precedence over the outbound command statement. Note

Copyright  2002, Cisco Systems, Inc.

Cisco recommends using the access-list and access-group commands for ACLs instead of the outbound command because the outbound command is a PIX Firewall-specific command and Cisco is moving toward commands that are based on the Cisco IOS.

Access Control Configuration and Content Filtering

10-3

ACL Usage Guidelines • Higher to lower security level – Use an ACL to restrict outbound traffic. – The ACL source address is the actual (untranslated) address of the host or network. • Lower to higher security level – Use an ACL to restrict inbound traffic. – The destination host must have a statically mapped address. – The ACL destination address is the “global ip” assigned in the static command. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-5

The access-list command follows the same principles and guidelines as conduits when permitting or denying traffic. The following are guidelines to use when designing and implementing ACLs: ■

■

10-4

Higher to lower security –

The traffic is to be restricted outbound.

–

The source address argument of the ACL command is the actual address of the host or network.

Lower to higher –

Traffic is to be restricted inbound to a higher security level network or host.

–

The destination host must have a statically mapped address.

–

The destination address argument of the ACL command is the “global ip” address assigned in the static command.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

access-list Command pixfirewall(config)#

access-list acl_name [deny | permit] protocol {src_addr | local_addr} {src_mask | local_mask} operator port {destination_addr | remote_addr} {destination_mask | remote_mask} operator port • Enables you to create an ACL • ACLs associated with IPSec are known as “crypto” ACLs

pixfirewall(config)# access-list dmz1 deny tcp 192.168.1.0 255.255.255.0 host 192.168.0.1 lt 1025 • ACL “dmz1” denies access from the 192.168.1.0 network to TCP ports less than 1025 on host 192.168.0.1 © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-6

The access-list command lets you specify if an IP address is permitted or denied access to a port or protocol. In this document, one or more access-list command statements with the same ACL name are referred to as an “access list.” Access lists associated with IPSec are known as “crypto access lists.” By default, all access in an access list is denied. You must explicitly permit it. The show access-list command lists the access-list command statements in the configuration. The show access-list command also lists a hit count that indicates the number of times an element has been matched during an access-list command search. The clear access-list command removes all access-list command statements from the configuration.

CAUTION This command also stops all traffic through the PIX Firewall on the affected access-list command statements.

The no access-list command removes an access-list command from the configuration. If you remove all the access-list command statements in an access list group, the no access-list command also removes the corresponding accessgroup command from the configuration. Note

Copyright  2002, Cisco Systems, Inc.

The access-list command uses the same syntax as the Cisco IOS software access-list command except that the subnet mask in the PIX Firewall access-list command is reversed from the Cisco IOS software version of this command. For example, a subnet mask specified as 0.0.0.255 in the Cisco IOS access-list command would be specified as 255.255.255.0 in the PIX Firewall access-list command.

Access Control Configuration and Content Filtering

10-5

The syntax for the access-list commands is as follows: access-list acl_name [deny | permit] protocol { src_addr | local_addr} {src_mask | local_mask} operator port { destination_addr | remote_addr}{ destination_mask | remote_mask} operator port no access-list acl_name [deny | permit] protocol { src_addr | local_addr} {src_mask | local_mask} operator port { destination_addr | remote_addr}{ destination_mask | remote_mask} operator port show access-list

10-6

acl_name

Name of an ACL. You can use either a name or number.

deny

Does not allow a packet to travel through the PIX Firewall. By default, the PIX Firewall denies all inbound packets unless you specifically permit access.

permit

Selects a packet to travel through the PIX Firewall.

protocol

Name or number of an IP protocol. It can be one of the keywords icmp, ip, tcp, or udp, or an integer in the range 1 to 254 representing an IP protocol number. To match any Internet protocol, including ICMP, TCP, and UDP, use the keyword ip.

src_addr

Address of the network or host from which the packet is being sent.

local_addr

Address of the network or host local to the PIX Firewall. Specify a local_addr when the access-list command statement is used in conjunction with a crypto access-list command statement, a nat 0 access-list command statement, or a vpngroup split-tunnel command statement. The local_addr is the address after NAT has been performed.

src_mask

Netmask bits (mask) to be applied to src_addr, if the source address is for a network mask.

local_mask

Netmask bits (mask) to be applied to local_addr, if the local address is a network mask.

operator

A comparison operand that lets you specify a port or a port range. Use without an operator and port to indicate all ports. Valid operand keywords are lt, gt, eq, neq and range. Use range and a port range to permit or deny access to only those ports named in the range. For example, use range 10 1024 to permit or deny access only to ports 10 through 1024.

port

Services you permit or deny access to. Specify services by the port that handles it, such as smtp for port 25, www for port 80, and so on. You can specify ports by either a literal name or a number in the range of 0 to 65535.

destination_addr

IP address of the network or host to

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

which the packet is being sent. destination_mask

Netmask bits (mask) to be applied to dest_addr, if the destination address is a network mask.

remote_addr

IP address of the network or host remote to the PIX Firewall. specify a remote_addr when the access-list command statement is used in conjunction with a crypto access-list command statement, a nat 0 accesslist command statement, or a vpngroup split-tunnel command statement.

remote_mask

Netmask bits (mask) to be applied to remote_addr, if the remote address is a network mask.

Note

Copyright  2002, Cisco Systems, Inc.

For inbound connections, destination_addr is the address after NAT has been performed. For outbound connections, destination_addr is the address before NAT has been performed.

Access Control Configuration and Content Filtering

10-7

access-group Command pixfirewall(config)#

access-group acl_name in interface interface_name • Binds an ACL to an interface • The ACL is applied to traffic inbound to an interface

pixfirewall(config)# access-group dmz1 in interface dmz • ACL “dmz1” is bound to interface “dmz”

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-7

The access-group command binds an ACL to an interface. The ACL is applied to traffic inbound to an interface. Only one ACL can be bound to an interface using the access-group command. The no access-group command unbinds the acl_name from the interface interface_name. The show access-group command displays the current ACL bound to the interfaces. The clear access-group command removes all entries from an ACL indexed by acl_name. If acl_name is not specified, all access-list command statements are removed from the configuration. The syntaxes for the access-group commands are as follow: access-group acl_name in interface interface_name no access-group acl_name in interface interface_name show access-group acl_name in interface interface_name clear access-group

10-8

acl_name

The name associated with a given ACL.

in interface

Filters inbound packets at the given interface.

interface_name

The name of the network interface.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Converting Conduits to Access Control Lists This section explains how to convert conduits to access control lists (ACLs).

ACLs Versus Conduits ACL

Conduit

An ACL applies to a single interface, affecting all traffic entering that interface regardless of its security level.

A conduit creates an exception to the PIX Firewall Adaptive Security Algorithm by permitting connections from one interface to access hosts on another.

c o n d u i t

ACL

It is recommended to use ACLs to maintain future compatibility. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-9

It is recommended to use ACLs rather than conduits in your PIX Firewall configuration. This is for future compatibility and greater ease of use for those familiar with Cisco IOS access control.The access-list command in the PIX Firewall uses the same syntax as the Cisco IOS command of the same name with one very important difference. The subnet mask in the PIX Firewall access-list command is specified the same as in all other PIX Firewall commands. This is very different from the Cisco IOS version of the command. Whether you are configuring a PIX Firewall for the first time or converting from conduits to ACLs, it is important to understand the similarities and differences in the two commands. Probably the most important similarity is that either can be combined with a static command to permit or deny connections from outside the PIX Firewall to access TCP/UDP services on hosts inside the network. More specifically, they can both be used to permit or deny connections from a lower security interface to a higher security interface. Some of the most important differences are as follow: ■

Copyright  2002, Cisco Systems, Inc.

A conduit operates from one interface to another, whereas the access-list command used with the access-group command applies only to a single interface. A conduit defines the traffic that can flow between two interfaces while an ACL affects all traffic entering the interface to which it is applied. ACLs have an implicit deny at the end. Once you apply an ACL to an interface, packets inbound to that interface must follow the rules of the ACL regardless of the interface security level. Access Control Configuration and Content Filtering

10-9

Note

■

The access-list command only controls access if used in conjunction with another command, the access-group command, which binds it to an interface. Conduits, however, are not bound to an interface at all.

■

The access-list and access-group command statements take precedence over the conduit command statements in your configuration.

■

ACLs are somewhat more flexible than conduits. They can be used to restrict connections from a higher security interface to a lower security interface as well as permit or deny connections from a lower security interface to a higher security interface.

Note

10-10

“Inbound" in this context means traffic passing through the interface, rather than the more typical PIX Firewall usage of inbound meaning traffic passing from a lower security level interface to a higher security level interface.

The conduit command is still supported to maintain backward compatibility of configurations written for previous PIX Firewall versions.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Avoid Mixing ACLs and Conduits c:\>ftp 172.16.0.10 >ftp: connect :Connection refused

Internet

• The PIX Firewall configuration pertaining to the DMZ contains – A NAT and a global pool for the DMZ. – Statics for the FTP server and mail server. – A conduit permitting access to the FTP server from the DMZ. – An ACL on the DMZ interface permitting access to the mail server. • The action specified for both the conduit and the ACL is permit.

© 2002, Cisco Systems, Inc.

Mail . . .From: [email protected] http://192.168.40.4

. . . The page cannot be displayed e0 .2 172.16.0.0/24 e2 .1

e1 .1

.3

10.0.0.0/24 .3

FTP .4 server

www.cisco.com

Mail server

CSPFA 2.1—10-10

In the example in the figure, an ACL is bound to the DMZ interface. The purpose of this ACL is to allow access from the DMZ clients to the mail server on the internal network, and the user is able to access the mail server. However, the user is unable to access the Internet or the internal FTP server. At first glance, both of the access problems the user is having may seem odd. Normally, with correctly configured NAT and global statements in place, connections from a higher-level interface to a lower-level interface should pass through with no problems. It would also seem that the user should be able to access the internal FTP server since the appropriate static and conduit have been configured. The following page shows the configuration that caused these problems.

Copyright  2002, Cisco Systems, Inc.

Access Control Configuration and Content Filtering

10-11

The Problem: ACLs Collide with Conduits pixfirewall(config)# nat (dmz) 1 0 0 pixfirewall(config)# global (outside) 1 192.168.0.20192.168.0.254 netmask 255.255.255.0 pixfirewall(config)# static (inside,dmz) 172.16.0.10 10.0.0.3 netmask 255.255.255.255 pixfirewall(config)# static (inside,dmz) 172.16.0.12 10.0.0.4 netmask 255.255.255.255 pixfirewall(config)# conduit permit tcp host 172.16.0.10 eq ftp any pixfirewall(config)# access-list 102 permit tcp 172.16.0.0 255.255.255.0 172.16.0.12 255.255.255.255 eq smtp pixfirewall(config)# access-group 102 in interface dmz Due to the ACL bound to the DMZ interface, • Users on the DMZ are unable to access the internal FTP server. • Users on the DMZ are unable to access the Internet. • Users on the DMZ are only able to access the internal mail server. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-11

The example in the figure shows a portion of the configuration in the PIX Firewall on the previous figure. In this example, a new network security specialist was given the task of setting up a DMZ and configuring its security. The security specialist was given the following instructions: ■

Allow users on the DMZ network web access to the Internet.

■

Allow users on the DMZ to access the FTP server on the inside.

■

Allow users on the DMZ to access the mail server on the inside.

The security specialist took the following steps to implement the policy: Step 1

NAT and global statements were created to allow outbound access from the DMZ. Testing proved this configuration to be correct.

Step 2

A static mapping for the internal FTP server’s 10.0.0.3 address was created, allowing it to appear to DMZ users as 172.16.0.10, which is an address on their own network. A conduit was then created to work with the FTP server’s static. This configuration was tested and found to be successful: access was permitted to the internal FTP server from the DMZ.

Step 3

Another static statement was created, which mapped the internal mail server’s 10.0.0.4 address to 172.16.0.12. Because Cisco was moving toward the use of ACLs rather than conduits, it was decided to try one. An ACL permitting DMZ users to access the mail server’s statically mapped address was created. Once again, testing proved that this configuration was working.

Step 4

After the previous three steps, the security administrator thought that the configuration were working, but when users began calling for assistance, the following was discovered: ■

10-12

Due to the implicit deny at the end of any ACL, even an ACL containing the permit option and no deny options can block traffic. When the ACL was bound to the DMZ interface, all traffic was denied except that which was

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

explicitly permitted by that ACL. This included denying access to a lower security level. ■

Even though a conduit expressly permits access to a host on a higher level interface, an ACL can override it, rendering it ineffective. This is why DMZ users were suddenly unable to access the FTP server.

The network security specialist decided to convert from conduits to ACLs, a task that proved amazingly easy.

Copyright  2002, Cisco Systems, Inc.

Access Control Configuration and Content Filtering

10-13

The Solution: Convert Conduits to ACLs pixfirewall(config)#

conduit permit | deny protocol global_ip global_mask [operator port [port]] foreign_ip foreign_mask[operator port[port]] pixfirewall(config)#

access-list acl_name [deny | permit] protocol {src_addr | local_addr} {src_mask | local_mask} operator port {destination_addr | remote_addr} {destination_mask | remote_mask} operator port

• global_ ip = destination_addr • foreign_ip = src_addr pixfirewall(config)# conduit permit tcp host 192.168.0.10 eq www any pixfirewall(config)# access-list acl_in permit tcp any host 192.168.0.10 eq www © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-12

Because it is now recommended that you use ACLs instead of conduits in the PIX Firewall, you may want to convert the existing conduits in your configuration to ACLs. A look at the syntax for the conduit and access list commands reveals that this is not a difficult task: conduit permit|deny protocol global_ip global_mask [operator port[port]] foreign_ip foreign_mask[operator port[port]]access-list acl_name [deny | permit] protocol {src_addr | local_addr} {src_mask | local_mask} operator port {destination_addr | remote_addr} {destination_mask | remote_mask} operator port

An ACL can be created from a conduit by using the conduit command arguments in the access-list command. This works because the foreign_ip option of the conduit command is the same as the src_addr in the access-list command, and the global_ip option in the conduit command is the same as the dest_addr in the access-list command. The following is an overlay of the conduit command on the access-list command (it can be used as a guide in your conversion): access-list acl_name permit|deny protocol foreign_ip foreign_mask foreign_operator foreign_port [foreign_port] global_ip global_mask global_operator global_port [global_port]

For example, the following conduit becomes the ACL shown beneath it: conduit permit tcp host 192.168.0.10 eq www any access-list acl_in permit tcp any host 192.168.0.10 eq www

The new access list command, like the conduit command, permits any host on the outside interface to access global IP address 192.168.0.10 over port 80 (www). Remember, however, that you must associate the ACL with an interface by using the access-group command.

10-14

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

ACLs in Action Internet

• Conduits are converted to ACLs. • The user is able to access the FTP server, mail server, and Internet. • All other traffic originating from the DMZ is denied.

Mail . . .From: [email protected] http://192.168.40.4

. . . Connecting to 192.168.40.4 .2

172.16.0.0/24 .1

.1

.3

10.0.0.0/24 .4

.3 FTP server

© 2002, Cisco Systems, Inc.

c:\>ftp 172.16.0.10 Connected to 172.16.0.10 . . .

Mail server

www.cisco.com

CSPFA 2.1—10-13

In the example in the figure, the user is now able to access the following due to the conversion to and correct usage of ACLs: ■

The FTP server on the internal network

■

The mail server on the internal network

■

The Internet (web access)

Due to the implicit deny, all other traffic from the DMZ is blocked.

Copyright  2002, Cisco Systems, Inc.

Access Control Configuration and Content Filtering

10-15

Making ACLs Work for You pixfirewall(config)# nat (dmz) 1 0 0 pixfirewall(config)# global (outside) 1 192.168.0.20-192.168.0.254 netmask 255.255.255.0 pixfirewall(config)# static (inside,dmz) 172.16.0.10 10.0.0.3 netmask 255.255.255.255 pixfirewall(config)# static (inside,dmz) 172.16.0.12 10.0.0.4 netmask 255.255.255.255 pixfirewall(config)# access-list 102 permit tcp 172.16.0.0 172.16.0.10 255.255.255.255 eq ftp

255.255.255.0

pixfirewall(config)# access-list 102 permit tcp 172.16.0.0 255.255.255.0 172.16.0.12 255.255.255.255 eq smtp pixfirewall(config)# access-list 102 permit tcp 172.16.0.0 255.255.255.0 any eq www pixfirewall(config)# access-group 102 in interface dmz

• Users on the DMZ are able to access the Internet, the internal FTP server, and the internal mail server. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-14

The figure shows the PIX Firewall configuration sample after the security specialist in the previous example converted conduits to ACLs. The configuration now contains three access-list statements, one to permit each of the following:

10-16

■

Allow users on the DMZ network web access to the Internet.

■

Allow users on the DMZ to access the FTP server on the inside.

■

Allow users on the DMZ to access the mail server on the inside.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Configuring Access Control This section explains how to configure access control to and through the PIX Firewall.

Deny Web Access to the Internet pixfirewall(config)# write terminal ... nameif ethernet0 outside sec0 nameif ethernet1 inside sec100 access-list acl_out deny tcp any any eq www access-list acl_out permit ip any any access-group acl_out in interface inside nat (inside) 1 10.0.0.0 255.255.255.0 global (outside) 1 192.168.0.20-192.168.0.254 netmask 255.255.255.0 ... • Denies web traffic on port 80 from the inside network to the Internet • Permits all other IP traffic from the inside network to the Internet

www Internet Internet

IP

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-16

In the figure, ACL acl_out is applied to traffic inbound to the inside interface. The ACL acl_out denies HTTP connections from an internal network, but lets all other IP traffic through. Applying an ACL to the inside interface restricts internal users establishing outside connections. Note

Copyright  2002, Cisco Systems, Inc.

The internal network addresses (10.0.0.0) are dynamically translated (192.168.0.20-254) to allow outbound connections.

Access Control Configuration and Content Filtering

10-17

Permit Web Access to the DMZ Internet

192.168.0.0/24 Web server .2

.2 .1 10.0.0.0/24

.1 172.16.0.0/24

pixfirewall(config)# write terminal ... nameif ethernet0 outside sec0 nameif ethernet1 inside sec100 nameif ethernet2 dmz sec50 ip address outside 192.168.0.2 255.255.255.0 ip address inside 10.0.0.1 255.255.255.0 ip address dmz 172.16.0.1 255.255.255.0 static (dmz,outside) 192.168.0.11 172.16.0.2 access-list acl_in_dmz permit tcp any host 192.168.0.11 eq www access-list acl_in_dmz deny ip any any access-group acl_in_dmz in interface outside ...

• The ACL acl_in_dmz permits web traffic on port 80 from the Internet to the DMZ web server. • The ACL acl_in_dmz denies all other IP traffic from the Internet.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-17

In the figure, ACL acl_in_dmz is applied to traffic inbound to the outside interface. The ACL acl_in_dmz permits Web connections from the Internet to a public Internet web server. All other IP traffic is denied access to the DMZ or inside networks. Note

10-18

The static mapping of an outside address (192.168.0.11) to the DMZ web server (172.16.0.2) is required to allow the traffic.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Partner Web Access to DMZ and DMZ Access to Internal Mail Internet

Partnernet Partnernet

DMZ DMZ

172.18.0.0/28

172.16.0.0/24 WWW server .2

.2 .1

.1

.1 .4

10.0.0.0/24 Mail server .4

© 2002, Cisco Systems, Inc.

Client

pixfirewall(config)# write terminal ... nameif ethernet0 outside sec0 nameif ethernet1 inside sec100 nameif ethernet2 dmz sec50 nameif ethernet3 partnernet sec40 static (dmz,partnernet) 172.18.0.17 172.16.0.2 static (inside,dmz) 172.16.0.11 10.0.0.4 access-list acl_partner permit tcp 172.18.0.0 255.255.255.240 host 172.18.0.17 eq www access-group acl_partner in interface partnernet access-list acl_dmz_in permit tcp host 172.16.0.4 host 172.16.0.11 eq smtp access-group acl_dmz_in in interface dmz ...

• The ACL acl_partner permits WWW traffic from the partner subnet 172.18.0.0/28 to the DMZ intranet web server. • The ACL acl_dmz_in permits host 172.16.0.4 mail access to 10.0.0.4.

www.cisco.com

CSPFA 2.1—10-18

In the figure, ACL acl_partner is applied to traffic inbound to the partnernet interface. The ACL acl_partner permits Web connections from the hosts on network 172.18.0.0/28 to the DMZ web server via its statically mapped address, 172.18.0.17. All other traffic from the Partner network is denied. The ACL acl_dmz_in is applied to traffic inbound to the DMZ interface. The ACL acl_dmz_in permits the host 172.16.0.4 mail access to the internal mail server on the inside interface. All other traffic originating from the DMZ network is denied.

Copyright  2002, Cisco Systems, Inc.

Access Control Configuration and Content Filtering

10-19

VPN Solution: Dual DMZ and VPN Concentrator pixfirewall(config)# pixfirewall(config)# write write terminal terminal

VPN Client 172.30.0.7

Server 172.26.26.50/24

... ... static static (dmz,outside) (dmz,outside) 192.168.0.12 192.168.0.12 172.16.0.5 172.16.0.5 netmask netmask 255.255.255.255 255.255.255.255 00 00 static static (inside,dmz2) (inside,dmz2) 10.0.21.0 10.0.21.0 10.0.0.0 10.0.0.0 netmask netmask 255.255.255.0 255.255.255.0

Internet

172.30.0.2 /24 .1 192.168.0.0/24

outside dmz

Pub 172.16.0.5 Pool 10.0.21.33-62

dmz2 inside

Priv 172.18.0.5

10.0.0.0 /24

route route dmz2 dmz2 10.0.21.0 10.0.21.0 255.255.255.0 255.255.255.0 172.18.0.5 172.18.0.5 11 access-list access-list IPSEC IPSEC permit permit tcp tcp any any host host 192.168.0.12 192.168.0.12 eq eq 443 443 access-list access-list IPSEC IPSEC permit permit esp esp any any host host 192.168.0.12 192.168.0.12 access-list access-list IPSEC IPSEC permit permit udp udp any any host host 192.168.0.12 192.168.0.12 eq eq isakmp isakmp access-group access-group IPSEC IPSEC in in interface interface outside outside access-list access-list WEB WEB permit permit tcp tcp 10.0.21.32 10.0.21.32 255.255.255.224 255.255.255.224 10.0.21.0 10.0.21.0 255.255.255.0 255.255.255.0 eq eq www www

Server 10.0.0.10

access-group access-group WEB WEB in in interface interface dmz2 dmz2 © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-19

In the VPN solution, the PIX Firewall has two dedicated interfaces connected to a Cisco Virtual Private Network (VPN) Concentrator. The dmz interface is connected to the VPN Concentrator’s public interface. The dmz2 interface is connected to the VPN Concentrator’s private interface. The VPN Concentrator is configured to assign VPN Clients an address from the 10.0.21.33−62 pool. A static route on the PIX Firewall is defined to route outbound traffic to the VPN Client. A static translation is needed on the PIX Firewall to allow for communication between the VPN Client and hosts on the inside network of the PIX Firewall. The PIX Firewall is configured with the following two ACLs to control traffic inbound from the Internet and outbound from the VPN Clients to the PIX Firewall inside network:

10-20

■

The PIX Firewall ACL “IPSEC” allows HTTPS traffic from the Internet to the public interface of the VPN Concentrator. The ACL “IPSEC” permits only IPSec traffic to the VPN Concentrator.

■

The PIX Firewall ACL “WEB” allows HTTP traffic from the VPN Clients (10.0.21.33−62) to the inside web server (10.0.0.10).

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

icmp Command pixfirewall(config)#

icmp permit | deny [host] src_addr [src_mask] [type] int_name • Enables or disables pinging to an interface

pixfirewall(config)# icmp deny any echo-reply outside pixfirewall(config)# icmp permit any unreachable outside • All ping requests are denied at the outside interface, and all unreachable messages are permitted at the outside interface

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-20

You can enable or disable pinging to a PIX Firewall interface. With pinging disabled, the PIX Firewall cannot be detected on the network. The icmp command implements this feature, which is also referred to as configurable proxy pinging. Note

By default, pinging through the PIX Firewall to a PIX Firewall interface is not allowed. Pinging an interface from a host on that interface is allowed.

To use the icmp command, configure an icmp command statement that permits or denies ICMP traffic that terminates at the PIX Firewall. If the first matched entry is a permit entry, the ICMP packet continues to be processed. If the first matched entry is a deny entry or an entry is not matched, the PIX Firewall discards the ICMP packet and generates the %PIX-3-313001 Syslog message. An exception is when an icmp command statement is not configured, in which case, permit is assumed. Note

Cisco recommends that you grant permission for the ICMP unreachable message type (type 3). Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPSec and PPTP traffic. See RFC 1195 and RFC 1435 for details about Path MTU Discovery.

The clear icmp command removes icmp command statements from the configuration. The syntax for the icmp commands is as follows: icmp permit | deny [host] src_addr [src_mask] [type] int_name no icmp permit | deny [host] src_addr [src_mask] [type] int_name clear icmp Copyright  2002, Cisco Systems, Inc.

Access Control Configuration and Content Filtering

10-21

show icmp permit | deny

Permit or deny the ability to ping a PIX Firewall interface.

src_addr

Address that is either permitted or denied ability to ping an interface. Use host src_addr to specify a single host.

src_mask

(Optional) Network mask. Specify if a network address is specified.

type

(Optional) ICMP message type as described in Table ICMP Type Literals

int_name

Interface name that can be pinged.

The following table lists the ICMP Type Literals that can be used in the type argument of the icmp command to designate which message types are permitted or denied. ICMP Type Literals

10-22

ICMP

Type Literal

0

echo-reply

3

unreachable

4

source-quench

5

redirect

6

alternate-address

8

echo

9

router-advertisement

10

router-solicitation

11

time-exceeded

12

parameter-problem

13

timestamp-reply

14

timestamp-request

15

information-request

16

information-reply

17

mask-request

18

mask-reply

31

conversion-error

32

mobile-redirect

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Securing Remote Configuration with SSH SSH client

Username: pix password: TelnetPassword

.50

172.26.26.0/24

pixfirewall(config)#

ssh ip_address[netmask][interface_name] • Specifies the host or network authorized to initiate an SSH connection to the PIX Firewall. pixfirewall(config)# ca generate rsa key 768

192.168.0.0/24 .2

10.0.0.0/24

pixfirewall(config)# ssh 172.26.26.50 255.255.255.255 outside • An RSA key pair is generated for the PIX Firewall using the default key modulus size of 768. • Host 172.26.26.50 is authorized to initiate an SSH connection to the PIX Firewall. © 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-21

PIX Firewall software versions 5.2 and higher enable you to remotely configure your PIX Firewall with a higher degree of security than was possible in prior versions. Prior to 5.2, the security of the remote configuration was limited to the security Telnet provided, which was lower-layer encryption and application security. Versions 5.2 and higher support the Secure Shell (SSH) remote functionality as provided in SSH version 1, which provides strong authentication and encryption capabilities. SSH, an application running on top of a reliable transport layer such as TCP, supports logging onto another computer over a network, executing commands remotely, and moving files from one host to another. Both ends of an SSH connection are authenticated, and passwords are protected by being encrypted. Since SSH uses RSA public key cryptography, an Internet encryption and authentication system, you must generate an RSA key-pair for the PIX Firewall before clients can connect to the PIX Firewall console. Your PIX Firewall must also have a Data Encryption Standard (DES) or Triple-Data Encryption Standard (3DES) activation key. The PIX Firewall allows up to five SSH clients to simultaneously access its console. You can define specific hosts or networks that are authorized to initiate an SSH connection to the PIX Firewall, as well as how long a session can remain idle before being disconnected. The ssh ip_address command specifies the host or network authorized to initiate an SSH connection to the PIX Firewall. The ssh timeout command lets you specify the duration in minutes that a session can be idle before being disconnected. The default duration is five minutes. Use the show ssh sessions command to list all active SSH sessions on the PIX Firewall. The ssh disconnect command lets you disconnect a specific session. Use the clear ssh command to remove all ssh command statements from the configuration, and use the no ssh command to remove selected ssh command statements. Copyright  2002, Cisco Systems, Inc.

Access Control Configuration and Content Filtering

10-23

The syntax for the ssh commands is as follows: ssh disconnect session_id no ssh disconnect session_id ssh ip_address [netmask] [interface_name] no ssh ip_address [netmask] [interface_name] ssh timeout mm no timeout mm show ssh [sessions [ip_address]] show ssh timeout clear ssh

10-24

ip_address

IP address of the host or network authorized to initiate an SSH connection to the PIX Firewall.

netmask

Network mask for ip_address. If you do not specify a netmask, the default is 255.255.255.255 regardless of the class of ip_address.

interface_name

PIX Firewall interface name on which the host or network initiating the SSH connection resides.

mm

The duration in minutes that a session can be idle before being disconnected. The default duration is 5 minutes. The allowable range is from 1 to 60 minutes.

session_id

SSH session ID number available from the show ssh sessions command.

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

Malicious Active Code Filtering The PIX Firewall can filter malicious active codes. Malicious active codes can be used in such applications as Java and ActiveX.

Java Applet Filtering • Java applet filtering enables an administrator to prevent the downloading of Java applets by an inside system. • Java programs can provide a vehicle through which an inside system can be invaded. • Java applets are executable programs that are banned within some security policies.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-23

The PIX Firewall supports a Java applet filter that can stop potentially dangerous Java applications on a per-client or per-IP address basis. Java applets may be downloaded when you permit access to port 80 (HTTP), and some Java applets can contain hidden code that can destroy data on the internal network. A solution to this problem is to use the filter java command to block all Java applets.

Copyright  2002, Cisco Systems, Inc.

Access Control Configuration and Content Filtering

10-25

filter java Command pixfirewall(config)#

filter java port[-port] local_ip mask foreign_ip mask • The filter java command filters out Java applets that return to the PIX Firewall from an outbound connection. • Some Java applets can contain malicious code that can manipulate data on the internal network.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-24

Java filtering enables an administrator to prevent Java applets from being downloaded by an inside system. Java applets are executable programs that are banned by many site security policies. The syntax for the filter java command is as follows: filter java port[-port] local_ip mask foreign_ip mask port[-port]

One or more ports on which Java applets may be received.

local_ip

The IP address interface with the highest security level from which access is sought.

mask

Wildcard mask.

foreign_ip

The IP address of the interface with the lowest security level to which access is sought.

Java programs can provide a vehicle through which an inside system can be invaded or compromised. When Java filtering is enabled, the PIX Firewall searches for the programmed “cafe babe” string and, if found, drops the Java applet. A sample Java class code snippet looks like the following: 00000000: café babe 003 002d 0099 0900 8345 0098

10-26

Cisco Secure PIX Firewall Advanced 2.1

Copyright  2002, Cisco Systems, Inc.

ActiveX Blocking

• ActiveX controls are applets that can be inserted in web pages or other applications. • ActiveX controls can provide a way for someone to attack servers. • The PIX Firewall can be used to block ActiveX controls.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-25

ActiveX controls, formerly known as Object Linking and Embedding (OLE) or Object Linking and Embedding control (OCX), are applets that can be inserted in web pages—often used in animations—or in other applications. ActiveX controls create a potential security problem because they can provide a way for someone to attack servers. Because of this potential security problem, you can use the PIX Firewall to block all ActiveX controls.

Copyright  2002, Cisco Systems, Inc.

Access Control Configuration and Content Filtering

10-27

filter activex Command

pixfirewall(config)#

filter activex port local_ip mask foreign_ip mask • Filters out ActiveX usage from outbound packets.

© 2002, Cisco Systems, Inc.

www.cisco.com

CSPFA 2.1—10-26

The filter activex command filters out ActiveX usage from outbound packets. The syntax for the filter activex command is as follows: filter activex port local_ip mask foreign_ip mask activex

Block outbound ActiveX, Java applets, and other HTML